roos3342

Thank you very much, this solves the problem!

I was just looking to remove it from the single product pages.

Thanks again.

Hey Eli,

I sent you an email w/ 3 files attached.

Thanks!

I guess I should also mention it’s not picking up the wp-options.php file that is being created as a part of the malware, also in the root. It is however getting the wpinstall-Copy.php file that is being created.

No problem, I hope it works for you! Let us know if you don’t mind ??

@onnawebdesign,

Thanks to some help from one of the plugin authors or developers, they looked at my situation and discovered the attempts were not actually coming from finding the renamed login page. They determined it was executed via the xmlrpc.php functionality in the wordpress core and for some reason the .htaccess rules the plugin was adding to help prevent the attack was being ignored by the host. Talking to the host (Dreamhost) they were unable to give an explanation as to why they ignore the rules, but they did offer the following code to add to the .htaccess file. When I added it, the attempts stopped immediately and I have not had an issue since. Perhaps it will help you too.

<Files xmlrpc.php>
order deny,allow
deny from all
allow from YOUR.IP.HERE
</Files>

Email sent!

Thanks.

@wpsolutions,

That tab shows the reason as being “login_failure”, so I”m assuming that is not the 404 lockout you are talking about.

@mra13 – I can login fine and you are correct, it is blocking the IP’s of the attempted logins, but I’m just concerned that it’s constant. I’ve never had this on a site before.

The even weirder thing is, I ran a test where I completely removed the wp-login.php file via FTP and I was still getting IP addresses being locked with the reason being a “login_failure”. I’m not quite sure how that happens?

Thanks Eli!

I have sent an email.

Yes sir, you are correct.

Thanks for your help.

Doing that makes the title just say “Products”. I will leave it like that for now. It’s better than it was. I wish I could figure out tho how to make it show Shop | Mintclothing Company without having to deactivate the All in one SEO plugin.

If I find anything else, I will post here.

Hi Peter, I was wondering if you had any more thoughts on this?

thanks.

Hi Peter,

I’m not sure why you would see something different than me? I’m seeing ProductsMint Clothing Company in firefox, safari and chrome.

For use original title I have that set to enabled. For Force Rewrites under performance, that is also set to enabled.

My header title tag looks like this:
<title><?php wp_title( '|', true, 'right' ); ?></title>

Thanks for looking at this, appreciate it!

Can anyone help me on this? What am I missing?!?!?!

I solved this problem, you can ignore the request. Thanks!

Thanks for the link. The user in that thread and myself have gone back and fourth now a few times, but still trying to figure it out. His patch only works for the galleries/albums. I still have the same problem when a single pic shortcode is used.

Upon the test send I get the red “X”. I can hit send now and it tells me everything has been sent, but nothing actually gets sent.

Thanks for the link. If you think of anything else to look at or try, let us know!

Thanks.