I have clients that host wordpress sites on web15, web16, and web17. None of them can access their wordpress control panel. This is new, and must have cropped up in the past week or so, but I don’t know exactly when. I know all of them had been working fine in the past.
[SIZE=11px][FONT=Tahoma]Your PHP settings have been disabled by an H-Sphere administrator.[/FONT][/SIZE]
[ul]
[li]Your current PHP configuration:[/li]–>
[li]This configuration was changed:[/li][/ul]
[SIZE=11px][FONT=Tahoma]Please bring your PHP configuration in compliance with admin settings or request your administrator to re-enable support of your settings.[/FONT][/SIZE]
[SIZE=11px][FONT=Tahoma]You don’t have permissions to access this page. This usually means one of the following:[/FONT][/SIZE]
[ul]
[li]this file and directory permissions make them unavailable from the Internet.[/li][li].htaccess contains instructions that prevent public access to this file or directory.[/li][/ul]
[SIZE=11px][FONT=Tahoma]Please check file and directory permissions and .htaccess configuration if you are able to do this. Otherwise, request your webmaster to grant you access.[/FONT][/SIZE]
This is obviously unacceptable. Please help. No resolution or response to ticket so far ([SIZE=2][FONT=arial][RS #ABL-13308[/FONT][/SIZE][SIZE=2][FONT=arial]-515][/FONT][/SIZE][SIZE=2][FONT=arial])[/FONT][/SIZE]
Every host is seeing this issue at some level, it is very massive over 100000 bots are brute forcing wordpress sites, without the blocks in place, the sites don’t work AT ALL, nor do many others due to MySQL getting slammed with bot connection requests.
Now, in ticket we are making a fix available with a script for each domain to run, it will allow to login again with some directions.
The limiting isn’t working so well however because it is using MySQL queries as well with some of those plugins.
the webhostingtalk forums mention this causing just as much problem, the true fix would be more of an htaccess/apache based plugin to solve it, as such attempts would still slam the DB server side.
WP has been very very vague, and I’ve been watching their forums for any mentions, and oh there have been, but they have been getting deleted quickly as well. Now there are posts going about why it was deleted
Question - the Jodo fix for this: does it break on a ‘log-out’?
For example, when I log out I get kicked to the 403 error page, instead of going back to the login page - I guess that’s not really broken, just reflecting the fact the Word Press is looking for wp-login.php…
ah, probably is borked if looking for wp-login there, we didn’t edit every page, the script we run edits the vital ones to login, the logout process should still log you out, you can verify by trying to load the admin page url again.
One more question: will WordPress updates break this?
I noticed two sites want me to update to 3.5.1…maybe I should update first before submitting tickets, but I imagine WordPress will be posting more updates in the days to come! (At least I hope they do!)
updating may redo the links back to wp-login.php but our script changes are not interested in versions and can be rerun and fix them again to the new login URL.
Just wanted to jump in and say thanks to Stephen and all of the Jodo support group in helping to get this straightened out. I have 11 or 12 sites using WordPress and am working with support to get the logins done.
Not sure if I have just been lucky but I have only had one customer so far that actually noticed the problem!
Another question for Stephen and Staff…I realize that it is the end users responsibility for much of the security measures and updates that are needed for Wordpress and other CMS type systems…but was wondering if some type of sticky thread could be created showing what some of the most important plugins there are that would possibly help more with security..so many people (and growing) are using Wordpress that something like that might be helpful all around.
