MikeHarrison

My dearest Andrea…

I can imagine you do get some folks who do not read the documentation before attempting to use your plugin.

However, I most certainly did read it. ALL of what was provided. And here’s what it says:

== Installation ==

1. Upload the login-dongle directory to your wp-content/plugins directory.
1. Click on Activate from the Plugins menu.

= Configuration =

1. Configure site settings from the Settings menu.
1. Configure your admin settings from the Users/Your Profile menu.
1. Configure other users settings from the Users/All Users menu.

I performed all of those steps exactly as outlined. If there are other steps, they are not in the READ ME file that came in the folder, neither is any more information (apart from the message displayed to would-be hackers) on the settings page. And, as you’ll see in my first post here (the one you clearly didn’t read completely before going off on me for not reading), that I began by saying I was successful in installing *AND* configuring the plugin.

You will also see that I said no challenge appeared (I guess that would be the bookmarklet). NOTHING appeared except the login page (which, according to you, isn’t supposed to appear until after the challenge is answered correctly). It was only after I entered my username and password that the screen went blank.

From the configuration page:

Bookmarklet for loggin in Send on next update
Whenever you change the challenge or the response, after saving remember to drag and drop into your bookmarks this raw or encoded bookmarklet.

Was I supposed to do something with this? I don’t arbitrarily select options (the checkbox) unless instructed to do so. If I was supposed to check this, that is something else that wasn’t in the instructions.

I configured the plugin according to the instructions provided.
There was NO CHALLENGE. Instead, I got my regular login screen.

Now, whether or not there is more documentation somewhere that you failed to make reference to, I accept your apology for publicly ‘speaking to me’ like an idiot when, in fact, it was you who didn’t completely read what I posted.

Again, I’m sure you do get messages from those who don’t read instructions. But that does not give you the right to assume that is always the case. It so happens, you’re communicating with (and insulting) someone who’s been using computers and installing software for over 25 years. You? Take a pill.

Thanks for your reply. But my question was whether I can work on the new theme while the existing theme remained as the active theme (in other words, I don’t want to switch to the new theme until I’m ready to).

@govpatel: Thank you! I just checked your suggested plugin, but I found it is apparently compatible only up to WP v2.84 (I’m at 3.1.4).

And, again, the IP address in question has only accessed the login page (numerous times), but they apparently have not yet attempted to login.

I’m willing to bet that – by now – the would-be hacker would have attempted to access using a different IP address. I won’t know until I receive my site stats tomorrow morning.

Thanks everyone. Your help is very much appreciated!

Thanks, Peter.

This has happened twice. On this most recent incident (yesterday), I found the IP address to be apparently located in Thailand. My site stats tell me there are a several referrals every day from Russia and China, but yesterday’s incident – requests for specifically for the login page – was made many, many times.

I’m using the plugin ‘Limit Login Attempts,’ but it hasn’t shown any actual lock-outs, so I guess what I’m seeing is just repeated accesses to the login page itself.

In the interim, I’ve denied access by this IP address to the entire site with my htaccess file.

Is there anything else/more I should be doing?

Thanks!

Thanks, Christine! I’ll do that.

Mystery solved! (Thanks, Jonas). A plugin was somehow preventing the post from appearing.

A while back, I began noticing increasing access of my wp-cron.php page. Again, I know nothing about this stuff, but the number of accesses were quite high; more so than that of all other pages. I Googled that topic and many suggestions pointed to a plugin that would control that. That is the plugin I deactivated to make this blog post visible again.

But now, can anyone suggest what to do about the cron issue, if I can’t use the plugin?

Again, many thanks!

Thanks, Jonas. (Great profile pic!) But, no, the post is marked ‘Public.’

Thanks, Christine. Good thought, but it is indeed a post. (I just double-checked!)

But here’s an interesting twist: if I remain logged-in to my dashboard, and in another browser window I call up my blog page, the post in question WILL appear at the top of previous posts. Weird… but does that help?

Hi Michael (I got your name from your profile)…

Thanks very much for your speedy reply.

Please excuse me; I’m pretty much clueless on WordPress, and therefore hesitant about performing anything with my site with the exception of text updates, etc.

When you say ‘local server,’ do you mean to say I can install a clone of my site on my desktop computer (which sort of acts as a server when networked with my laptop)?

I do backup my online database; the most recent was just last week. Not quite sure what you meant by “known good file;” do you mean backups of the actual files that make up the website? If so, yes; I can easily copy everything to my computer (the one mentioned in the previous paragraph).

I certainly do appreciate that you probably have many things going on, but would you be able to offer a bit of guidance as I attempt to follow your example of creating the clone and – I hope it won’t come to this – reinstalling the site if anything should go wrong?

Again, my apologies for my lack of knowledge here.

Thanks, Michael.

Bear in mind that the password should be for the SQL account. That may not (and really should not) be the same as your host’s dashboard password.

I didn’t think they were the same, either. All along, my ftp client used a different password than that of my SQL account. When things went bonkers yesterday, I thought I had unwittingly screwed something up. So that’s when I began playing with the passwords, hoping to land on the right one.

HOWEVER… a friend pointed out earlier today that the whole problem might be caused by the hosting company. And, sure enough, within the last 10 minutes, the whole problem disappeared and everything seems to be back to normal. (I’ve logged in successfully three times while composing this post.)

Having read last Friday that WordPress 3.2 was about to be released, I asked my hosting company if their SQL and php apps met the requirements for WordPress 3.2 and their answer was very vague. Now I know why.

Thank you all for trying to help me. I appreciate it very much. I’m so sorry that – due to my lame hosting company – your time was wasted.

My apologies; I may be giving confusing information, so please let me clarify:

When I attempt to login to my site’s WordPress dashboard, my browser doesn’t even display the WordPress login screen where I would enter my username and password. That’s when I get ‘Error establishing a database connection’.

However, when I attempt to manage my site’s database on my ‘hosting dashboard’ (within my hosting company’s website), a login screen is displayed but it rejects the password that matches the password in the wp-config.php file, and it also rejects new passwords I create.

So sorry for the confusion.

I try entering the password that is in wp-config and I am denied access. Then I change the password using my lame hosting company’s equally lame ‘hosting dashboard’ and try to login again using the new password, and I am still denied access.

Hi Paul…

1. Yep, everything was fine until yesterday.
2. a. Database is at least in-place. I can see it via ftp and there doesn’t appear to be a problem viewing it via hosting company website.
2. b. The password had changed, but I’ve since created a new one.
2. c. The last modification date on the wp-config.php file was May 26, and everything was fine from then until yesterday.

So, as far as I can tell, the only thing that’s different is the password for the database. I’m just wondering why, after several hours, that I’m still unable to login.

Thanks, Paul.

Mike