Just recently discovered that neither my client or I can login to our WordPress website. Here are the details:
Plugins: Contact Form 7, Envira Gallery Lite, Fusion Core (part of avada theme), Updraft Plus, WordPress SEO, WP Retina 2x, WP Updates Notifier, Login Security Solution, Sucuri Scanner
Initially, the login page was requesting a password reset which is typical if too many false attempts have been made from a single user (part of Login Security Solution) plugin.
We tried to reset via the link in the email sent by wordpress. The new password generated is “invalid” when we try to login after the reset.
I FTP-ed in and changed functions.php to force a password reset. When I login with the new password, the login screen appears to be accepting the password, but rather than loading the dashboard, it loads the login screen again. Our Sucuri plugin emails an alert that the login was successful (which of course, it was not).
Next, I changed the name of all the plugin folders to make sure it wasn’t a plugin causing the trouble. Same result.
Then, I looked at my htaccess file. It was overwritten with:
Files *.php deny from all /Files
I restore the htaccess file to it’s original code. Still same login behavior.
I look through the rest of the site for other htaccess files. I change the names of htaccess files in the following places in order to disable them:
wp-content
wp-content/uploads
wp-content/uploads/sucuri
wp-includes
Still same login behavior.
Not sure what to try next. Not sure what triggered the problem. I was able to login on 12/22. My odd htaccess file had a modification date of 12/7. Client tried to login on 1/3 and was unable.
Any help would be greatly appreciated!!
