Someone is mousing

[cubeSilence]

Dear Support

I’m going crazy about the thousands of such E-Mails I get 😉 I’m using it in a multi-site Installation (WordPress 4.3.1) and it seems that you did not disable the notification for this scenario (4.3.1 Multisite). Everytime someone is opening a page in Admin Backend, I get a notification – IP address is the server IP by the way – that someone is mousing…

Please fix that or tell me how to stop those messages.

Thanks!

[Suman M.]

Hi, please disable “Spy Notify” option from HMWP General settings tab.

[cubeSilence]

As far as I tested it, this functionality is only for 404 error pages not for those “mousing” functionality. And if it is: it occurs since 4.3. Is it a known bug? Will you fix it? I still want those mousing notifications that are not created by the wordpress 4.3 update check (I think its the auto-update feature).

[Suman M.]

It’s not a bug. As I said above, you can turn off such emails by unchecking “spy notify” option.

• This reply was modified 9 years, 3 months ago by Suman M..

[cubeSilence]

OK if its not a bug: why do I get EACH TIME an Administrator visit an Backend site (doesnt matter which network site) I get the following message:

Hi-
This is Hide My WP plugin. We guess someone is researching about your WordPress site.

Here is some more details:
Visitor: {IP-Address-of-our-Wordpress-Server}
URL: http://{backend-url}/wp-admin/upgrade.php?step=1
User Agent: WordPress/4.3.1; http://{backend-url}

Best Regards,
Hide My WP

Seems to be a bug, if wordpress itself is doing this, right ;-)? I have no update plugins installed… its default behavior of the new wordpress version… (I think this exists since upgrading to 4.3.1).

[Suman M.]

Actually, you should only get such email if you try to access wp-admin or wp-login.php without security keyword (if direct access to wp-admin is disabled from HMWP backend and is available only like /wp-login.php?hide_my_wp=1234)

If you are getting such email every time you login to backend successfully, then yes there is issue. And did you disable “spy notify” option?

[cubeSilence]

Im getting this message on EVERY page refresh! (save, link click, …) when an admin is logged in.

_____
Since I updated Hide my WP there is a little bit strange .htaccess Generation for all entries:
RewriteRule ^something/(.*) /something-else?AMHidO_pw=my_pw [QSA,L]

But in the settings I specified just “pw” as Login-Query. Not “AMHidO_pw”. The Password itself “my_pw” is correct again.

Maybe its a/the cause? Or a bug? Or a feature?

[Suman M.]

Can you please turn off “full hide” option from HMWP general settings tab and see if the issue still exists?

[cubeSilence]

Full hide is not active.

Here’s my config:

{“li”:”{my-serial}”,”import_options”:””,”export_options”:””,”multisite_config”:””,”debug_report”:””,”help”:””,”custom_404″:”0″,”custom_404_page”:”350″,”trusted_user_roles”:{“editor”:”editor”},”replace_mode”:”quick”,”hide_wp_login”:”on”,”login_query”:”pw”,”admin_key”:”{my-password}”,”hide_wp_admin”:”on”,”spy_notifier”:”on”,”customized_htaccess”:”on”,”separator”:””,”cdn_path”:””,”email_from_name”:””,”email_from_address”:””,”antispam”:”on”,”full_hide”:””,”hide_other_wp_files”:”on”,”disable_directory_listing”:”on”,”disable_canonical_redirect”:””,”hide_admin_bar”:”on”,”avoid_direct_access”:””,”direct_access_except”:”index.php, wp-content/repair.php, wp-comments-post.php, wp-includes/js/tinymce/wp-tinymce.php, xmlrpc.php, wp-cron.php, wp-admin/upgrade.php”,”exclude_theme_access”:””,”exclude_plugins_access”:””,”new_theme_path”:”/static”,”new_style_name”:””,”minify_new_style”:””,”new_include_path”:”/static/lib”,”new_plugin_path”:”/static/ext”,”rename_plugins”:”all”,”new_upload_path”:”/file”,”replace_comments_post”:”/comment_submit”,”replace_admin_ajax”:”/ajax”,”new_content_path”:””,”separator2″:””,”new_admin_path”:””,”separator3″:””,”author_enable”:”1″,”author_base”:”/editors”,”author_query”:”member”,”author_without_base”:””,”feed_enable”:”1″,”feed_base”:”/feed”,”feed_query”:”sitefeed”,”post_enable”:”1″,”post_base”:”/blog/%year%/%monthnum%/%day%/%postname%/”,”post_query”:””,”page_enable”:”1″,”page_base”:””,”page_query”:””,”paginate_enable”:”1″,”paginate_base”:””,”paginate_query”:””,”category_enable”:”1″,”category_base”:””,”category_query”:””,”tag_enable”:”1″,”tag_base”:””,”tag_query”:””,”search_enable”:”1″,”search_base”:””,”search_query”:””,”nice_search_redirect”:””,”disable_archive”:””,”disable_other_wp”:””,”remove_html_comments”:””,”replace_javascript_path”:”0″,”remove_feed_meta”:”on”,”remove_other_meta”:”on”,”remove_default_description”:”on”,”remove_ver_scripts”:”on”,”remove_body_class”:””,”clean_post_class”:””,”remove_menu_class”:””,”clean_new_style”:””,”replace_in_ajax”:””,”replace_wpnonce”:””,”enable_ids”:””,”ids_level”:”0″,”ids_admin_include”:””,”ids_cookie”:””,”logger_link”:””,”log_ids_min”:”5″,”block_ids_min”:”30″,”email_ids_min”:”30″,”exception_fields”:”REQUEST.comment[new_line]POST.comment[new_line]REQUEST.permalink_structure[new_line]POST.permalink_structure[new_line]REQUEST.selection[new_line]POST.selection[new_line]REQUEST.content[new_line]POST.content[new_line]REQUEST.__utmz[new_line]COOKIE.__utmz[new_line]REQUEST.s_pers[new_line]COOKIE.s_pers[new_line]REQUEST.user_pass[new_line]POST.user_pass[new_line]REQUEST.pass1[new_line]POST.pass1[new_line]REQUEST.pass2[new_line]POST.pass2[new_line]REQUEST.password[new_line]POST.password[new_line]POST.hide_my_wp.%[new_line]REQUEST.hide_my_wp.%[new_line]POST.%import%[new_line]REQUEST.%import%[new_line]REQUEST.newcontent[new_line]POST.newcontent”,”ids_html_fields”:””,”replace1″:””,”replace2″:””,”undo”:””,”db_ver”:”4.54″}

[Suman M.]

So you have rules in htaccess like
RewriteRule ^something/(.*) /something-else?AMHidO_pw=my_pw [QSA,L]
even when Full Hide option is disabled?
Can you please let us know your website’s wp-admin details (as private reply) so that we can have a look at the issue further.

[cubeSilence]

Yes exactly.

I need to copy everything to our test environment first. I’m not allowed to give admin access to third party companies. Arent there any debug information that I can provide to you?

[Suman M.]

This reply has been marked as private.

[cubeSilence]

===========================================================
 WP Settings
===========================================================
WordPress version: 	WPMU 4.3.1
Home URL: 	http://network-domain.tld
Site URL: 	http://network-domain.tld
Is SSL: 	false
Is RTL: 	false                                          
Permalink: 	/blog/%year%/%monthnum%/%day%/%postname%/

============================================================
 Server Environment
============================================================
PHP Version:     	5.4.45
Server Software: 	Apache
WP Max Upload Size: 100 MB
Server upload_max_filesize:     100M
Server post_max_size: 	100M
WP Memory Limit: 	64M
WP Debug Mode: 	    false
CURL:               true
fsockopen:          true

Here is the missing information besides the options. Because it is in an Multisite-Installation, there are no plugins listed.

[cubeSilence]

Is this bug fixed in the new version 5?

[Suman M.]

Hi, do you mean “AMHidO_pw=my_pw” at the end or HMWP rewrite rules? This isn’t a bug and is used by HMWP internally.

[Author]

Posts