Defender keeps disconnecting ManageWP

I am having problems with Defender and ManageWP, Defender keeps disconnecting ManageWP from our websites. I tried whitelisting the ManageWP IP in the Defender settings but that didn't work.

  • Nastia
    • Support Rock Star

    Hello Paul

    I hope you are doing well!

    I apologize for the inconvenience that this issue has caused. Our developers are still working on this issue as it looks quite complex. I've pinged our developers about this issue, if they have found a workaround, we will keep you posted.

    In the meantime would you please make sure all Manage WP IPs are whitelisted, as mentioned in here:
    https://managewp.com/troubleshooting/general/managewp-ips-can-white-list

    We appreciate your patience!

    Kind regards,
    Nastia

  • Dimitris
    • Support Star

    Hello there Paul,

    hope you're doing well and I'm really sorry for the frustration on this.
    I've already shared this with our developers who are already working on this, myself or another colleague of mine will keep you posted here as soon as possible.

    Thank you,
    Dimitris

  • Paul Stoakes
    • WPMU DEV Initiate

    Ok, so I've done some more testing and can confirm a couple of things and would like other to test the same as I have.

    It's definitely related to the login expiration time from what I can see. I re-connected a website to ManageWP and then once reconnected, I set the login expiration time in defender to 1 day. Sure enough, that one website got disconnected the next day and would no longer synchronise with ManageWP.

    Then, from my desktop I logged into the back end of that WordPress installation using my admin account details. Then simply hit refresh on managewp dashboard and it instantly re-connected that disconnected WordPress installation.

    That's something that has never happened before, a disconnected installation reconnecting outside of me reconnecting from the ManageWP dashboard.

    All of the above says to me that ManageWP isn't properly handling cookies expirations and logging in again? What are your thoughts and can you test this?

  • charles_montgomery
    • WPMU DEV Initiate

    I am still waiting for a solution as well. I was recently told my Manage WP:

    Hello Charles,

    I have checked our logs and I could see that we still got the same error message - 403 Forbidden. I could also see that it was due to our IP being blocked by Defender - please see the screenshot: http://prntscr.com/nboz4j <now inaccessible, sorry>

    The WPMU Dev Defender plugin, like every security plugin, has the potential to lock us out if they think our requests are potentially malicious, in those cases, they usually lock out our management IP address, 54.191.137.17, and allowing it to access your website again will help with those connection issues.

    I hope this helps - is there a way to whitelist an IP inside of Defender?

  • charles_montgomery
    • WPMU DEV Initiate

    So I found the whitelist option in Defender on the IP Lockouts page then IP Banning Tab, this url may get you straight there (with your own domain of course):

    /wp-admin/admin.php?page=wdf-ip-lockout&view=blacklist

    And you can get all of Manage WP's IPs here - click the download text to get them all easy to copy/paste:

    https://managewp.com/troubleshooting/general/managewp-ips-can-white-list

    So far I have one website that seems to be working fine on both. A Theme update I did in Manage WP was reflected in WPMU Dev dashboard less than a minute later so I think they are getting along now.

    Hope that helps!

  • Paul Stoakes
    • WPMU DEV Initiate

    WPMU Dev, I need someone's email address, I have a developer from ManageWP and they would like to talk and resolve this issue.

    The issue is definitely related to the login cookie expiration and they need to work out a mechanism where the whitelist will also allow for a bypass on the login cookie expiration time or some other cool idea.

    Which ever way, I have an email contact and they say they haven't heard from anyone at WPMU Dev so I would like to connect you two and resolve this issue once and for all...

  • Dimitris
    • Support Star

    Hello there charles_montgomery,
    hope you're doing well and appreciate the feedback on this, already shared with our developers.

    Dear Paul Stoakes,
    our developers are still working on it and first tests didn't show that login duration could cause that and their testing connecting sites are looking good. Despite that, I've already shared your latest feedback and asked for a contact person so I could share with you. :slight_smile:

    Warm regards,
    Dimitris

  • Paul Stoakes
    • WPMU DEV Initiate

    Hi There,

    there are multiple issues then. I have an issue that I can reproduce exactly every 24 hours as I have a 1 day logout set on a test website.

    1. Every 24 hours, I refresh managewp and the website is disconnected from managewp.
    2. a. If I go directly to the login page of the wordpress website and log in there, without taking any actions on managewp at all at this point.
    b. or if I log in directly from managewp again.
    c. or if I disable defender pro
    3. But then once logged into managewp, i then refresh the interface and the connection is made again.
    4. Go back to step 1 in 24 hours.
    I have another installation that I have set to two days and every 48 hours, I can repeat the steps above.
    If on the first instance I set it to 3 days, it stays connected for 3 days, then when I set it to 1 day, it stays connected for one day...

    It is like clockwork.

    ManageWP have confirmed that login cookies are the issue they are seeing.

  • Paul Stoakes
    • WPMU DEV Initiate

    btw, I just checked managewp and another website had disconnected. I fixed the connection by going directly to the website and logging into the website with the same credentials as used to maintain the connection with ManageWP and came back, refreshed managewp and hey presto, connected again...

    Login cookies <drops mic>

  • Paul Stoakes
    • WPMU DEV Initiate

    Given that I've been experiencing this issue for over a year with no progress and that is pretty much the same experience as quite a few other users. Are you sure you don't want me to put you in touch with the guy from ManageWP that wants to work with you to resolve this as soon as possible?

    It really is a pain and I currently have 23 disconnected websites that I have to go through and reconnect again and every 7 days I have to reconnect 45+ WordPress installations at various points throughout that time depending on the day I enabled the login timeout time...

  • Paul Stoakes
    • WPMU DEV Initiate

    charles_montgomery have you tried testing with a 1 day timeout in Defender Pro?

    Dimitris any update from the developers? Have you tried testing a 1 day login timeout? It takes about 10 minutes to setup and you'll repro the same behaviour as me within 24 hours... Also, ManageWP came back to me today asking if there was any developer contact they could speak to about the login cookie timeout?

  • Dimitris
    • Support Star

    Hello there Paul Stoakes

    Our developers are still unable to replicate this using the login duration. I'm setting this up now in a testing site of mine, along with all settings/tweaks from Defender. I've also asked a couple more colleagues of mine to set up this as well so we get better results. We'll keep you posted here as soon as we've got any insights over this.
    I've also asked again our developers and contacting ManageWP directly, will also inform you if there's a movement like this. :slight_smile:

    Thank you,
    Dimitris

    • Paul Stoakes
      • WPMU DEV Initiate

      I've passed on the details to the contact within managewp.

      As of 10 minutes ago, I had 38 of my installations of WordPress disconnected in ManageWP. I didn't touch manage WP to correct the issue and re-connect them. I went directly to each account and signed in with my administrator account on each one in turn.

      Then I CMD+R'd the managewp page and each of the ones that was disconnected was then re-connected without issue.

      So there are 38 instances of a login cookie refresh resolving the connectivity issue. I didn't touch anything else at all.

      • Dimitris
        • Support Star

        Appreciate the cooperation on this! :slight_smile:

        I can see that ManageWP already contacted us and I forwarded the email to our Defender lead developer. Meanwhile, I'm already testing the beta version of Defender 2.1.3, as it includes some adjustments in order to reduce the risk of forcing login. We'll keep you posted here as soon as there're any valuable insights.

        Thank you,
        Dimitris

  • Dimitris
    • Support Star

    Hey there all! :slight_smile:
    Hope you're doing well and I'm really sorry for the long waiting time here.

    I'm attaching a beta of the upcoming version 2.1.3. Could you please grab a backup of your website, install it and let us know how that goes?

    Warm regards,
    Dimitris

  • JEANETTE
    • New Recruit

    Dimitris no I didn't - I missed that :slight_smile: my version will be whatever the latest version is... I update all my plugins weekly.

    I also took off the two factor authentication too but not sure that changed anything.

    I just logged into Manage WP and all my sites are connected...

  • Paul Stoakes
    • WPMU DEV Initiate

    I installed the beta version on the instance that disconnected every 24 hours because that is when the login disconnect was set to. Since installing, ManageWP has remained connected. That is fantastic!

    When does this become release code, I'm hoping that the 43 instances I'm about to manually log back into to refresh the connection to ManageWP, this will be the last time!

    • Dimitris
      • Support Star

      Really appreciate the feedback and cooperation on this Paul! :slight_smile:

      I'm going to inform lead Defender developer about this confirmation. I really can't provide and ETA about the release, I can already see it in our QA queue though, so it shouldn't take long.

      Thank you,
      Dimitris

Thank NAME, for their help.

Let NAME know exactly why they deserved these points.

Gift a custom amount of points.