After a brute force attack I cant login

[jrhodk]

• And I get no other options to get in. - I get the message that the attackers have broken in, but what do I do to login as a legitimate user!? - I get no message to change pwd!? When I try to login I get the message that I have to input my username or emailadress and the system will send me a pwd reset mail, but if I write my emailaddress I get the message that the admin email pwd cant be reset. - And I get no mail with a pwd reset link.. - If I write admin nothing appearently happens.

[convissor]

That's odd you can't change your password. Can you please copy and paste the error message you're getting? What happens if you type in admin instead of your email address?

Once you do that, your first step, run this MySQL query: delete from wp_usermeta where meta_key = 'login-security-solution-pw-force-change' and user_id = 1;

Your user name is admin? Your second step is creating a new admin level account that uses a name other than admin, then disable the account named admin.

[jrhodk]

In an attempt to stop the attacks I have renamed the index.php in /wp-admin

• but the attacks continues anyway.. Im not getting any error when I use admin instead of my mailadress - it tells me that the system will send me an email with at link to reset my pwd, but the email never arrives.. - Even thou I get a email now and then from the securitysystem about the attacks and mails about that the attacks have succeded (we know its only me - but the system dont...).. I have 4 wordpress sites and on the others I have disabled the admin account, but I cant access this - but running your sql sentence might be the solution - What does it do!?

2013/4/29 Daniel Convissor notifications@github.com

That's odd you can't change your password. Can you please copy and paste the error message you're getting? What happens if you type in admininstead of your email address?

Once you do that, your first step, run this MySQL query: delete from wp_usermeta where meta_key = 'login-security-solution-pw-force-change' and user_id = 1;

Your user name is admin? Your second step is creating a new admin level account that uses a name other than admin, then disable the account named admin.

— Reply to this email directly or view it on GitHubhttps://github.com/convissor/login-security-solution/issues/11#issuecomment-17147541 .

/* My sites: http://bedreit.dk Indspark.blogspot.com Raskdiscover.blogspot.com

[jrhodk]

After comitting the sql sentence I could log in! I have changed the option to send me mails for every 30 attack and I get one every 10 minute! - Would you consider an option to deactivate the login totally acording to some kind of timetable?

I could live with only being able to login 2 hours a day - my webhotel would be happy about such a system, I guess..

With regards & Respect John

//* bedreit.dk

Den 29/04/2013 kl. 04.10 skrev Daniel Convissor notifications@github.com:

That's odd you can't change your password. Can you please copy and paste the error message you're getting? What happens if you type in admin instead of your email address?

Once you do that, your first step, run this MySQL query: delete from wp_usermeta where meta_key = 'login-security-solution-pw-force-change' and user_id = 1;

Your user name is admin? Your second step is creating a new admin level account that uses a name other than admin, then disable the account named admin.

— Reply to this email directly or view it on GitHub.

[convissor]

That query removes the flag that LSS makes to tell itself that you have to change your password.

The password reset emails are sent by WordPress. But both WordPress and LSS can produce error messages if a non-existent user name is put in. Exactly what error message did you get when you tried the reset using your email address?

While you're in the database, you should look select * from wp_users where id = 1\G to make sure you're using the right user name and email address.

[jrhodk]

The annoying thing was that I didnt get any error messages - the mail with a link to password reset, just never arrived, but I do get a lot of statusmessages about the brute force attacks.

Did you get my other mail, where I suggest a total closedown of the login possibility according to a timetable the user defines. - I could for example use only a 2 hour window, which I think my webhotel might be rather fond of = less traffic to the site...

With Regards John Rask

//* bedreit.dk

Den 30/04/2013 kl. 04.03 skrev Daniel Convissor notifications@github.com:

That query removes the flag that LSS makes to tell itself that you have to change your password.

The password reset emails are sent by WordPress. But both WordPress and LSS can produce error messages if a non-existent user name is put in. Exactly what error message did you get when you tried the reset using your email address?

While you're in the database, you should look select * from wp_users where id = 1\G to make sure you're using the right user name and email address.

— Reply to this email directly or view it on GitHub.

[convissor]

In your initial report you said "but if I write my emailaddress I get the message that the admin email pwd cant be reset." Please try the password reset process with your email address then copy/paste the resulting error message here.

[convissor]

There have been a few fixes in recent releases that probably cover your problem.