Fresh-Media

Hi,

Thanks for your question.

That is indeed the main functionality of the plugin: block hackers after too many login attempts. And because this plugin uses .htaccess to block an IP, it gives you the best protection possible.

JP

Thanks!

Thanks!

Hi,

Thanks for your post!

I think the methodology of the plugin works different then what you expect.

When a hacker reaches the specified limit of failed login attempts, the IP address of the hacker will be added to the .htaccess file: ‘deny from 0.0.0.1’ in your example. Then that IP address has no more access to your website.
The whitelist is stored in the database. IPs in the whitelist won’t be added to the .htaccess.

I hope this makes it more clear for you. Please let me know if you have more questions!

JP

Hi,

Thanks for your post.

Currently, there is no way to show the blocked IPs on the frontend. Because of performance reasons, the plugin is not being loaded on the frontend; the actual blocking is done via the .htaccess.

Why would you like to display the blocked IPs on the frontend?

Thanks.

JP

Hi,

I’m sorry, but I don’t really understand what you mean. Could you try to explain in more detail?

Thanks.

JP

Hi,

Thanks for your post.

You should change includes/htaccess.php, line 70, to:
if (!filter_var($IP, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {

By using the FILTER_FLAG_IPV4 as third argument, only valid IPv4 addresses will be blocked.

JP

Hi,

Thanks for your post.

I will take a look at it, and include the fix in the next version.

JP

Hi,

I’ve just released version 1.5.2 with a bugfix.

Thanks again for reporting it!

JP

That’s a good work-around. A problem is that the hacker can still access images, javascript, etc. I will try to solve that with the bugfix.

I will update this thread when I release the bugfix.

I’m very glad that you appreciate the plugin! I don’t have a donation-link. But, if you would like to, you can make a transfer via Paypal to [email protected].

JP

Hi,

Thanks for your post.

That’s a serious bug, thanks for reporting it. I will take a look at it and will release a bugfix next week!

JP

Hi,

Thanks for your post.

I have no idea why that is happening.
Did you see any blacklisted IPs at the settings page when the htaccess file contents were erased? Those are directly listed from the htaccess file.
If so, can you please send me the contents of the corrupt htaccess file at [email protected]?

JP

Maybe the htaccess file has a wrong owner.
Can you try the following: remove the htaccess file (make a backup first!), then save permalinks. Then WP will generate the htaccess file for you (with the correct owner).

JP

Hi,

Thanks for your post.

Have you checked if the .htaccess path is correct on the settings page?

JP

Yes they are! ??

The biggest difference is that they do not use the .htaccess file to block a hacker.

JP