After successfully logging into admin I seem to be getting this message in a browser auth dialog:

Brute force protection, Please use these credentials: User = 'u' and Password is the answer to 1+1”

What's causing this and how do I disable it? Very annoying!


  • Sounds sketchy. I just searched the Craft app folder for "Brute force protection" and "Please use these credentials" and don't get any matching results. – Ben Parizek Oct 12 '16 at 5:56
  • 1
    Are you on shared hosting? I wonder if this is something that a hosting provider setup for http auth on urls like /admin ? Can you take a screenshot? – joep Oct 12 '16 at 7:57
  • Thanks for the suggestions - it may be related to this precaution our shared host have taken: support.webhost.co.nz/index.php?/Openhost/Knowledgebase/Article/… Seems Craft has been lumped in with the Wordpress solution :( – Ryan Marshall Oct 12 '16 at 14:42
  • All signs point to this being an issue with hosting, not with Craft. Closing this as "off topic". – Lindsey D Oct 12 '16 at 18:42
  • I'm voting to close this question as off-topic because it is a hosting issue, not a Craft issue. – Lindsey D Oct 12 '16 at 18:43

That message definitely isn't coming from Craft natively.

My guess is either:

  1. You've got a Craft plugin installed that's listening to onBeforeLogin and/or onLogin events and is performing some custom business logic

  2. Your host has some library/extension/etc. installed globally that is affecting your Craft install.

|improve this answer|||||
  • Thanks Brad- I was actually going to delete it outright, turns out it is the host. – Ryan Marshall Oct 12 '16 at 21:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.