Stephen Quirk

Hello,
You would want to edit the file via FTP/SFTP, not via the WordPress Dashboard. I would also strongly recommend switching to Jetpack and using the Protect feature as we are no longer supporting/updating BruteProtect.

Thanks!

Not supported means we’ve not been dedicating time to answering questions or adding features. All time has been dedicated to the Protect feature in Jetpack.

The update to the plugin adds a message that we’re no longer issuing API keys for new users.

This is not a problem I’m familiar with as being from BruteProtect. The previous user had moved the file.

Please consider contacting your hosting company as I’ve seen the issue mentioned in relation to a couple different hosts.

If it is BruteProtect related, you’ll want to delete the plugin via FTP and we recommend moving to Jetpack’s Protect feature.

Thanks!

We’ve tried to clarify the prompts when setting it up for a network.

Here’s a little more info:
https://jetpack.me/support/multisite-protect/

Hello,
Here is a fix for that issue:

https://bruteprotect.com/faqs/error-bp100/

Thanks!

Both BruteProtect and Jetpack’s Protect feature secure xmlrpc in the same way.

Yes, many items are turned on by default, but they can be turned off very easily.

Soprano, can you give me more information on what you’re seeing for speed issues? If you install Jetpack and only run the Protect feature, it really should be very similar to BruteProtect. There can be a delay caused by hitting the API servers, but those are currently the same servers for both plugins. If you haven’t tried Jetpack for some time, it’s worth giving a try for some of the new features and improved experience.

Hello,
Yes, switching to the Protect feature in Jetpack is recommended. If you are locked out of BruteProtect, you can either wait for the lock to reopen or delete the plugin via FTP and then whitelist your IP address. This experience is improved in Jetpack as you can also whitelist via WordPress.com, even if you’re locked out.

leihan you should confirm that’s not your IP by taking a look at https://www.whatsmyip.org/

Thanks!

The Protect feature in Jetpack is the replacement for BruteProtect and that feature will be updated and maintained in Jetpack. BruteProtect the standalone plugin will no longer be updated.

Thanks!

Hello!
Jetpack doesn’t require XMLRPC at the root of your domain, but it does expect xmlrpc.php to be in your WordPress folder (e.g. same level at wp-login.php).

XMLRPC isn’t inherently vulnerable, but is one of the methods that is tried. Jetpack Protect (and BruteProtect before it) would help with blocking access.

Jetpack support would be happy to communicate directly with your host with additional details. A total and absolute block of a standard, built-in feature of WordPress is overkill.

You can also turn off any features you wouldn’t use.

Hope this helps!
Stephen

Hello,
It’s normal behavior for you to still see the attack occurring and it’s possible for something like a DDoS to happen while using the plugin. BruteProtect’s function is to prevent a bot from figuring out your password, but it can’t doesn’t prevent it from knocking on the door.

Hope this helps!

Hello,
nickth, this support thread is for BruteProtect and not Protect within Jetpack. If you’re getting this specific error, you’re most likely using BruteProtect and this article should help: https://bruteprotect.com/faqs/error-bp100/

If you’re using Jetpack’s Protect feature, you can just disable that without deactivating the entire plugin.

Let me know if I misunderstood or if you have any additional questions.

Thanks!
Stephen

dcaceres, can you try what Rocco has suggested above? FTP and delete BruteProtect and switch to Jetpack would be best place to start. Thanks!

We’re going to run the API server until the end of 2015. You can read more details here:
https://bruteprotect.com/ending-support-for-my-bruteprotect/

Thanks again!