Help: Entire website blocked

Discussion regarding Joomla! 3.x security issues.

Moderators: Bernard T, mandville, fcoulter, PhilD, General Support Moderators

Forum rules
Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Forum Post Assistant / FPA - If you are serious about wanting help, you will use this tool to help you post.
Post Reply
Wizard_TPG
Joomla! Apprentice
Joomla! Apprentice
Posts: 5
Joined: Wed Aug 22, 2007 2:35 am

Help: Entire website blocked

Post by Wizard_TPG » Wed Mar 20, 2019 10:55 pm

Guys,

I am recieving the following message on both my main joomla site and the administrator site.

Your IP address has been blocked because there were too many unsuccessful login attempts in a short time. Your IP address is: [ redacted ].

The ip address of [ redacted ] is my bluehost web server address.

I have a second joomla website on the same account that is running fine.
Both have the latest version of joomla

Things I have tried:
- Enabling debug (in configuration.ini) - Nothing shown
- Enabling error reporting to maximum - nothing shown
- Manually setting enable to 0 for any security plugins that I had installed in the database (bfstop, centrora and jhackguard)
- Replacing index.php with a very basic index.php (to test that php is not the issue) - worked fine

The website is http: [ redacted ]


Thanks in advance guys
Last edited by toivo on Thu Mar 21, 2019 8:13 am, edited 1 time in total.
Reason: mod note: removed URL and IP address

User avatar
toivo
Joomla! Master
Joomla! Master
Posts: 11046
Joined: Thu Feb 15, 2007 5:48 am
Location: Oxford, UK

Re: Help: Entire website blocked

Post by toivo » Wed Mar 20, 2019 11:44 pm

Does your site use an extension to improve its security, for example Admin Tools?
Toivo Talikka, Global Moderator
troubleshooting smtp and other articles http://talikka.com/joomla

Wizard_TPG
Joomla! Apprentice
Joomla! Apprentice
Posts: 5
Joined: Wed Aug 22, 2007 2:35 am

Re: Help: Entire website blocked

Post by Wizard_TPG » Thu Mar 21, 2019 1:06 am

After my site was hacked last year I installed several security extensions.
bfstop
Centrora
jhackguard
Admin Tools

I have just got back form the doctor and everything is working now.
But this is the second time this week that this has happened so I really need to identify the cause.

User avatar
toivo
Joomla! Master
Joomla! Master
Posts: 11046
Joined: Thu Feb 15, 2007 5:48 am
Location: Oxford, UK

Re: Help: Entire website blocked

Post by toivo » Thu Mar 21, 2019 7:41 am

Good to hear, the block must have timed out. This is a real problem because anyone can trigger the block if the IP address is the proxy server of your host, instead of the IP address of the end user.

The block may be originating from one of the first three extensions because the message displayed by the Web Application Firewall (WAF) of Admin Tools starts with ''You are a spammer, hacker or an otherwise bad person", unless it default message has been modified in the configuration of WAF.

If you have the installation packages of the three extensions, expand them and use a text search tool or just an editor and the language files to find the start of the message "Your IP address has been blocked". Once you locate it, read from the documentation of that extension how an IP can be removed from the blacklist.

It would be better to uninstall the extension found to be the culprit, because obviously it is not smart enough to detect correctly the source IP address from where the hack attempt or invalid login comes from.
Toivo Talikka, Global Moderator
troubleshooting smtp and other articles http://talikka.com/joomla

User avatar
toivo
Joomla! Master
Joomla! Master
Posts: 11046
Joined: Thu Feb 15, 2007 5:48 am
Location: Oxford, UK

Re: Help: Entire website blocked

Post by toivo » Sat Mar 23, 2019 8:41 am

It is also possible that the reverse proxy server or load balancer of your host produces incorrect request headers, which are then inspected by the security plugins.

You had already tried to disable those plugins but that did not seem to remove the block. Therefore you should talk to your host and find out about their reverse proxy server if it does some filtering and blocking.
Toivo Talikka, Global Moderator
troubleshooting smtp and other articles http://talikka.com/joomla

User avatar
Slackervaara
Joomla! Guru
Joomla! Guru
Posts: 990
Joined: Sat Aug 13, 2011 6:27 am

Re: Help: Entire website blocked

Post by Slackervaara » Tue Mar 26, 2019 8:51 pm

It might be BfStop that locked your out:
What can I do in case I have locked myself out?
Read this:
https://github.com/codeling/bfstop/wiki/FAQ

User avatar
JAVesey
Joomla! Hero
Joomla! Hero
Posts: 2016
Joined: Tue May 14, 2013 1:21 pm
Location: Cardiff, Wales, UK
Contact:

Re: Help: Entire website blocked

Post by JAVesey » Tue Mar 26, 2019 9:59 pm

Slackervaara wrote:
Tue Mar 26, 2019 8:51 pm
It might be BfStop that locked your out:
What can I do in case I have locked myself out?
Read this:
https://github.com/codeling/bfstop/wiki/FAQ
Good call - that message is from BruteForceStop.

Curious as to how the OP has ended up in this situation though; can only be that it's self-inflicted if it is BFStop. If gives you a countdown of attempts left then blocks the IP which must, by definition, be the Op's own IP.

One way round it would be to login via another device, e.g. a mobile phone over 4G, if the original attempts were via a device connected via wifi/local router, i.e. use a device with a different i.p. address.
John V
Cardiff, Wales, UK
Uses Joomla 3.9.8

User avatar
Webdongle
Joomla! Master
Joomla! Master
Posts: 37026
Joined: Sat Apr 05, 2008 9:58 pm

Re: Help: Entire website blocked

Post by Webdongle » Tue Mar 26, 2019 10:07 pm

Reboot your router and see if your ISP sets a different IP address. That should get you in. Also please viewtopic.php?f=806&t=969442
http://www.weblinksonline.co.uk/
https://www.weblinksonline.co.uk/updating-joomla.html
"The definition of insanity is doing the same thing over and over again, but expecting different results": Albert Einstein

Wizard_TPG
Joomla! Apprentice
Joomla! Apprentice
Posts: 5
Joined: Wed Aug 22, 2007 2:35 am

Re: Help: Entire website blocked

Post by Wizard_TPG » Tue Mar 26, 2019 11:57 pm

toivo wrote:
Sat Mar 23, 2019 8:41 am
It is also possible that the reverse proxy server or load balancer of your host produces incorrect request headers, which are then inspected by the security plugins.
I had a good look at the bfstop access attempt logs and I would say that toivo is on the money with his post.
The log shows login attempts from several users that I know are valid users but all attempting to connect from the same ip address, which happens to be the same address as the web host.

To fix the issue I have put my webhosts ip in the bfstop whitelist and this seems to have fixed the issue.

My site has been using bfstop for well over 12 months without issue and this has happened out of the blue. Because of this I would highly recommend other bfstop users to whitelist their webhost ip, just in case.

User avatar
JAVesey
Joomla! Hero
Joomla! Hero
Posts: 2016
Joined: Tue May 14, 2013 1:21 pm
Location: Cardiff, Wales, UK
Contact:

Re: Help: Entire website blocked

Post by JAVesey » Wed Mar 27, 2019 5:24 pm

Wizard_TPG wrote:
Tue Mar 26, 2019 11:57 pm
To fix the issue I have put my webhosts ip in the bfstop whitelist and this seems to have fixed the issue.
Good news :D
Wizard_TPG wrote:
Tue Mar 26, 2019 11:57 pm
My site has been using bfstop for well over 12 months without issue and this has happened out of the blue. Because of this I would highly recommend other bfstop users to whitelist their webhost ip, just in case.
I've been using BFStop for about 6 years and not seen this before. You advice is sound :)
John V
Cardiff, Wales, UK
Uses Joomla 3.9.8


Post Reply

Return to “Security in Joomla! 3.x”