Login problems with All in One WP Security & Firewall
Today's a technical post. If you're a web developer and ever get locked out of your WordPress login after installing the All In One Security & Firewall plugin, this post might help. Here I'll walk you through my problem and how I solved it.
1 min read
How did the error occur?
While I was logged in and setting up the plugin, everything still worked fine. The next day, though, I could no longer log in. The login page returned error code 403 – Forbidden. I could only fix this temporarily by resetting the .htaccess file, since the problem was actually coming from the database.
When I tried to log in, I got the error message "Error: Invalid credentials," and eventually I was locked out entirely.
For me, the problem only started after I turned on automatic logout.
The solution
First, I unlocked myself. That can be done either via a link on the login page or through the database. To do this, you delete the entries in the DB tables "aiowps_failed_logins" and "aiwps_permanent_block." Even after that, though, I still couldn't log in. After deactivating all plugins via FTP, I knew the AIOWPS plugin was the culprit. Renaming it via FTP let me log in, but I couldn't change the settings. As soon as it was active again, I got blocked. So it was tied to the database.
Since all the plugin's tables were empty, it had to be in the settings. And sure enough, I found it in the "options" table. There, I deleted the content of the aio_wp_security_configs option. That finally let me log in. But that wasn't quite the end of it. For the settings you make in the plugin to actually save again, you should go into the settings once and disable all security features and firewall rules. Once that's done, you can set up the plugin again from scratch.