Kristopher Larson said
You fixed it!!

Mod security randomly started blocking it. My Rule sets must of updated with a new rule recently.

 

Thanks for the help guys!  

I don’t get this, @yellow-swordfish 

We must have been typing at the same time there.

I think the standard WP requested url after a change password IS the WP user profile panel isn’t it? That’s one of the reasons we offer the the option to block users from the backend – because WordPress itself does not.

These login issues are a difficult one – and most of the time I wish we had not bothered to include a login form – because it can be affected by other plugins, issues with mod_security etc., 

OK – just seen your next post. Mod Security works on the server and looks for patterns in urls and compares the request against those patterns looking for possible attacks. Web Developers hate it because it can stop a url from working and doesn’t ever inform the user what is going on.

Hosts will update mod security patterns as new potential patterns are made available. Most hosts will turn it off for you, if you ask, so you can check if that is the cause. If it is, they can whitelist the request so that it works. When testing, always clear your browser cache. But first you need to ask your host for their help with this.

I am not really sure what should I ask to my provider… to be honest I don’t understand what you answered, so I find difficult even to translate it into Italian to make my question to them.

Can you tell me in much simpler words, if possible, please?

Ask your host if your server has the ‘mod_security’ module active and – if so – can they disable it immediately so that you can test a particular URL that is giving problems and might be being blocked by the module.

It would be most unusual for them to say no to this request.

ok thanks, I will ask them!

If it works out that mod_security is NOT to blame then first thing to do is double-check your SP settings at admin > components > login and registration. And if they are al OK, examine other WP plugins to see if any of those might be adding redirects which might have a greater priority and are getting processed.

Am I not correct in recalling that you were going to change your login procedures just a couple or so weeks back? Does the issue lie in that area?

I am waiting for an answer from the provider. In the meantime here is a screnshot of my login configuration.

And I may have mentioned that I would like to have a better login procedure, more intuitive, but I have not done anything about it yet…

Andy,

the support of my host just wrote to me that the mod_security is not active (it has never been).

So the configuration screen I put it in the previous post and the check you wrote “examine other WP plugins to see if any of those might be adding redirects which might have a greater priority and are getting processed” I don’t know how to do it.

I did not install new plugins in fact I deactivated some (I used to have a little chat screen an the top of the forum that I have now removed).

Please help, I am stuck…

I would love to help but I don’t actually know what I can do. If redirects are being ignored – and we use them here so we know they fundamentally do work – then it has to be something that is ignoring or taking over the redirect that SP has set.  Which is quite easily done by the way.

So by examining your other plugins I simply meant check all available option settings on all of them to ensure they don’t have an alternate redirect set somewhere.

We can also ask @mr-papa if he has any other ideas…

Ok I get it now, I will check the other plugins then but I guess, as I did not install anything new, that nothing would interfere. Still I will look at them all. And wait for Mr Papa input too! Thanks

ok I checked all plugins settings and cannot find anything related to login stuff.

Also I did a few time some tests subscribing as a new user. I did this a long time ago but I am surprised of one thing… I remember that as a user that just registered I would receive an email with a random password. With that password I would need to access to the login with the provided link (in the email) and then I could change the password. Now this is not happening. As a newly registered user I now receive an email of welcome giving me 2 links: one to the homepage of the forum and another to retrieve the password. Is this something new on WP? This is very strange and as I did not change anything, only updated WP and plugins, I don’t know how to go further…

I know that WordPress changed its login procedures a couple of versions back but I have to admit that I am not sure what the process is now. I think they wanted to get away from sending the login name and a password in the same email but I may be wrong.

I will need to try it somewhere. I will see if I can set up a test system but it wont be quick I am afraid…

oh ok! Now that would make sense as I made a test with an older version of WP. Don’t worry, I will create a blog with my provider and make some tests. If that is the case then maybe this is the way it is supposed to be, from WP point of view. Still that would mean that I need to find a way to redirect new users, as they have just changed the password, on the home page, as now they would ne redirected to the WP user profile screen. You can try on my forum to see what I mean by creating a test user for yourself.

I will let you know what I find out, I must resolve this, I am sure a lot of people just give up, especially considering they do this from mobile phone (most of my blog readers use mobile phones)…

You can prevent your users from ever visiting the admin/wordpress side of your website by using the block user feature we provide – forum admin > options > global options. Controls who can and who can not access the back end. That includes their own profile page in the WP admin.

But that has always been checked on my forum, one of the first things I did, if you mean this screen: