Why am I locked out by attempted logins from my own IP

Just stating general stuff here > BPS Login Security (LSM) does not lock anyone out by their IP address. The email alert captures the IP address of the person who was locked out and sends that IP address in the email alert to the Administrator of the website or the email address that you have chosen for where email alerts are sent to.

I believe the question you are asking is why is your server IP address being captured and displayed in the LSM email alert instead of your public IP address (ISP assigned IP address).

The BPS Code that gets the IP address of the person who is locked out is this: $ip_address = esc_html( $_SERVER['REMOTE_ADDR'] );

PHP $SERVER variables: https://www.php.net/manual/en/reserved.variables.server.php

‘SERVER_ADDR’
The IP address of the server under which the current script is executing.

‘REMOTE_ADDR’
The IP address from which the user is viewing the current page.

Logical reasons for why your server IP address is being captured and displayed in the email alert instead of the IP address of the user could be caused by a Proxy configuration mistake or a server config mistake. Do you have a Proxy server? Do you have anything else installed that might affect the REMOTE_ADDR variable? If you have no idea what these things mean then contact your web host and refer them to this forum topic. So they understand the issue/problem.

• This reply was modified 5 years, 1 month ago by AITpro.

Is the issue/problem still occurring or is it resolved?

Thank you for replies: The issue continues.

I understand BPS doesn’t lock anybody out by their IP, but that it captures the username against which the login was attempted as well as the IP# of the ‘person’ or script or bot that fails the login.

– The username against which the login attempt is targeted is NOT a published user or author name.

– The IP# being captured is the IP# for shared hosting on my dedicated server.

– I do not have a proxy server.

– BPS works well on other domains on the same server.

The BPS lockout report cause a concern that somebody or some script is getting into the server or site through some kind of back door and trying to then login as one of the admin accounts. But it is only happening on this one account.

Can I safely whitelist my own server IP# or would that give somebody with back door access a way in to hack the site?

What do you mean exactly for this “The username against which the login attempt is targeted is NOT a published user or author name.” Are you saying this particular username is not displayed publicly on your website or are you saying the user account does not exist?

Does the same problem happen for all user accounts? Example: If you create a test user account and that test user account gets locked out, do you also see your server IP address in the Login Security email alert?

Did you get this figured out?

Resolving old thread.

• This reply was modified 4 years, 9 months ago by AITpro.