- This topic has 3 replies, 1 voice, and was last updated 1 year, 2 months ago by
.
-
Posts
-
I love this plugin and have used it on all of our client WORDPRESS sites. Recently I began to notice that it was no longer working though on our client sites. Specifically:
1. They would go to admin to login. The badge would be showing at bottom for recaptcha without errors.
2. They would use proper logins.
3. The page would refresh, right back to the login page without logging them in.
4. After multiple attempts WORDFENCE would then block them for multiple incorrect login attempts.I tried everything I could think of (disabling all plugins, default theme, remove wordfence, etc.) and ultimately I had to delete this plugin entirely on their sites to allow them back in. These were the same exact v2 invisible recaptcha keys I have been using forever without issue. I even tried creating new ones from multiple accounts and still same issue.
This morning I setup a fresh installation of WORDPRESS and your plugin only for testing. Same exact issue. I need help! 🙂 Could this be a server issue, and if so what could be the cause?
How can I privately provide you with URL and admin logins on the fresh install so you can see this?
FYI: I am using the following setup:
– WORDPRESS: 5.2.2
– PHP: 7.3
– INVISIBLE RECAPTCHA: Your latest versionAfter doing some extensive research and testing, I finally found the cause. Apparently there was a custom MODSEC rule that caused this issue. I whitelisted the rule, then it began working fine again.
APACHE/LOGS/ERROR_LOG
[Tue Jul 02 16:14:33.651483 2019] [:error] [pid 5233:tid 47730625201920] [client 24.192.180.182:52199] [client 24.192.180.182] ModSecurity: Access denied with code 402 (phase 2). Operator EQ matched 0 at ARGS. [file “/etc/apache2/conf.d/modsec2/lw_virtual_patches.conf”] [line “41”] [id “5000214”] [msg “wordpress login missing action and or wp-submit arguments.”] [severity “WARNING”] [tag “critical_wordpress_protection”]
You must be logged in to reply to this topic.