Dear Mike,
Long time that you reported this issue, and thanks for it. Actually this is very valuable information. In the past, I had a lot of spurious reports of users who reported similar issues. I never had a lead on what was going on. Adding a lot of “cache prevention” headers seemed to solve a lot of these issues but not all.
iTheme security seems to do something with the login mechanism itself. I would need to have a closer look at it but it might just do what it promises: “lock down WordPress” and “Strong Password Enforcement”. I bet that this is what happened afterall.
I think I cannot do anything about it since iTheme security surely sees this plugin as a “backdoor”. It would likely be possible to integrate this plugin with iTheme security from my side but that would then defeat the purpose of iTheme security. So yeah, I think in this specific case it is one or the other.
But thanks for the report! This actually might help me in the future to find the reason why this plugin does not work for some wordpress users.
