BulletProof Security Forum

This file > /public_html/wp-content/plugins/bulletproof-security/includes/arq-cron.php is the BPS Pro AutoRestore|Quarantine file. It is not malicious and is instead necessary.  What does “detect and clean” mean. Is your host scanner falsely detecting the arq-cron.php file as malicious and removing it?

Send me a WordPress Administrator login to your website to: info@ait-pro.com so I can see what is happening.

BPS Pro is not causing the 403 error. So it is either coming from the LiteSpeed Cache plugin or your computer Browser (add-in or plugin or maybe corrupt Browser cache) or your web host is blocking something and locking you out of your site. If BPS Pro was locking you out of your site it would be permanent and not intermittent. Note: You have a Linux server and a LiteSpeed API. So make sure you are not enabling LiteSpeed settings for a LiteSpeed server since you have a Linux server.

Your web host scanner has removed these 4 harmless lines of code below from the arq-cron.php file. This is causing AutoRestore|Quarantine to malfunction. Please have your web host exclude this BPS Pro file from being scanned by the server scanner.

$xamppPath1 = $_SERVER['DOCUMENT_ROOT'].'\.htaccess';
$xamppPath1b = $_SERVER['DOCUMENT_ROOT'].'/.htaccess';
$xamppPath2 = $_SERVER['DOCUMENT_ROOT'].'\index.php';
$xamppPath2b = $_SERVER['DOCUMENT_ROOT'].'/index.php';
$xamppPath3 = $_SERVER['DOCUMENT_ROOT'].'\wp-config.php';
$xamppPath3b = $_SERVER['DOCUMENT_ROOT'].'/wp-config.php';

The only 403 error that I see logged in the BPS Security Log is this one below, but it is a one time event. Looks like some sort of autologin script to login to your website from within your web host control panel.

[403 GET Request: January 1, 2023 10:09 pm]
BPS Pro: 17
WP: 6.1.1
Event Code: BFHS - Blocked/Forbidden Hacker or Spammer
Solution: N/A - Hacker/Spammer Blocked/Forbidden
REMOTE_ADDR: 172.98.32.151
Host Name: 172.98.32.151
SERVER_PROTOCOL: HTTP/1.1
HTTP_CLIENT_IP: 
HTTP_FORWARDED: 
HTTP_X_FORWARDED_FOR: 172.98.32.151, 172.98.32.151
HTTP_X_CLUSTER_CLIENT_IP: 
REQUEST_METHOD: GET
HTTP_REFERER: https://hpanel.hostinger.com/
REQUEST_URI: /create_autologin_63b204a29603b.php
QUERY_STRING: 
HTTP_USER_AGENT: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36