8 {{ upvoteCount | shortNum }}
8 {{ upvoteCount | shortNum }}

Better WP Security is no more...

by Humbee360
6 replies
Hi folks, I used the BWPS security product for quite some time, it worked nicely did not stop everything, but sure slowed them down.

I was updating 100 WP websites recently, (took half a day) and I came across a change in ownership of BWPS, right away I start to think, Oh, No, this is not good and I was right.

iThemes has bought out the developer and now Im going to have to find another product, because there is No way to contact them (unless) your a paying customer.

I even found a bug, which basically creates a situation where your entire site goes down.

(its still in the last valid version of BWPS and in the new iThemes version)

So, if you are still using this plugin and your site goes down, usually with a 500 code.

Then here is how you fix it.

login to your control panel, edit .htaccess, (if you cant see .htaccess) go back one step and check the box that allows you to see .htaccess files.

once you into that, remove all the content except for this below.
Backup your file first.

# BEGIN WordPress <IfModule mod_rewrite.c> RewriteEngine On RewriteBase / RewriteRule ^index.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L] </IfModule> # END WordPress
Backup your file first.

This will allow you to once again login to your wordpress area.

(if you have a custom file, consider backing up the original file for reference)

Then disable the iThemes plugin, (you can decide if you want to keep it or delete it not my department)

Another thing to watch out for is if you do install it again, (the newer version) it automatically locks down .htaccess which means that if you have a plugin that uses .htaccess, (lots of them do)

Then you will have to manually turn that off in the software.

If the plugin fails to work (again) then you will have to disable it and then delete it.

Check your .htaccess file to verify that the buggy code written by iThemes security, is gone,

Then you can download it and try again.

Im going to be looking for an alternative as this looks to me more like a way to sell their other services and so far I have to say that its not looking too good to me.

There used to be a key code for plugins that needed a particular feature, I dont see that anymore, (must be in the pro version)

It was a great run but sadly, BWPS is not dead and cant really see using the broken version they have out now.
#security
  • Profile picture of the author RobinInTexas
    Rather than replacing all except the code you are citing, it would be better to restore the backup .htaccess that BWPS saves.

    I have quite a bit of stuff in my .htaccess files besides what BWPS adds. (about 200 lines worth)

    To replace it I would suggest using Wordfence (my preference). If you are really paranoid you could also install Bulletproof security, although I have over 50 WordPress sites using just Wordfence without any problems.
    Signature

    Robin



    ...Even if you're on the right track, you'll get run over if you just set there.
    {{ DiscussionBoard.errors[9067732].message }}
    • Profile picture of the author w13
      Originally Posted by RobinInTexas View Post

      To replace it I would suggest using Wordfence (my preference). If you are really paranoid you could also install Bulletproof security, although I have over 50 WordPress sites using just Wordfence without any problems.
      I agree with Robin, you should use Bulletproof plugin. That's good security plugin, and having no problems with it. That's plugin comes with new feature to avoid bruteforce attack.
      Signature
      Insta Niche Pack: 19 Awesome and Gorgeous Niche Websites.
      {{ DiscussionBoard.errors[9095261].message }}
  • Profile picture of the author Mr Bill
    Thanks for posting that tip Hum'.

    I'd also suggest getting a plugin like MainWP which allows you to (after adding child plugins to all your sites) update all your sites with one click. I have about 50 sites now and there's now way I could update them all manually again. It's almost a full time job.

    MainWP also has a "check security" feature that checks for common security leaks like "admin" usernames, exposed files, directories and version revealing...etc. Again, it's a one click "fix all" solution. It's free (search in the plugins directory) and I'm not associated with it but it's a real time saver especially if you have 100 blogs to update constantly.
    {{ DiscussionBoard.errors[9093809].message }}
    • Profile picture of the author kenzo22
      I think it wouldn't be off the topic if I suggest you guys to take a look at plugin in my signature We're quite confident that it's one of the best when it comes to security and maintenance of WP sites.
      Signature

      Backup and maintenance plugin for WordPress
      www.wpguards.com

      {{ DiscussionBoard.errors[9094516].message }}
  • Profile picture of the author RobinInTexas
    For brute force defense, I prefer Wordfence. I have it configured to block an IP for 60 days after one failed login attempt or an attempt on an invalid username like admin,
    Signature

    Robin



    ...Even if you're on the right track, you'll get run over if you just set there.
    {{ DiscussionBoard.errors[9100766].message }}
  • Profile picture of the author Tim Franklin
    I saw that too, when the plugin changed hands it had a bug, that was creating some big problems for some of my other plugins, when I uninstalled BWPS/iThemes the problems went away, but I had to manually edit the .htaccess file to get back into the website.

    I really liked that plugin too, but now its like a sales funnel, not really into that kind of sales approach, also they still have that bug its a regex issue with some long strings of code.

    No plugin is perfect, but there are some better alternatives out there now.
    Signature
    Bitcoin | Crypto | Blockchain Secrets |
    {{ DiscussionBoard.errors[9109115].message }}

Trending Topics