https://wordpress.org/support/view/plugin-reviews/better-wp-security/page/1
Even uninstalling the plugin doesn't fix the issue, you have to dig into .htaccess and wp-config.php files to remove the lines of code the plugin left.
=====================
The only way back in to my site is to disable the plugin via FTP. If I want to try to edit settings on the plugin, I have to delete it and re-install it, which only works temporarily. Then, after a few hours, the site locks down again.
=====================
To fix it you need to delete (or rename) your .htaccess file (then put in a blank one and make sure you update your permalinks once you're back in your admin panel), then delete (or rename) the entire iThemes crap plugin. Only then will you be able to access your admin panel.
=====================
The only way to gain access to your dashboard is to disable (rename) the plugin via ftp.
=====================
This was an excellent plugin until the developers decided to change the name. Then many experienced issues with it. I experienced one of the worst issues that can happen to someone who's not a programmer: I was totally locked out of my website and I had to fix it on my own. That's because no matter how much I tried communicating with them they never gave me an answer. If they want profit by selling tech support they should turn the plugin premium, not riddle it wih issues so people are forced to buy their support.

I recommend that you don't install this plugin if you can avoid it.
=====================
Nuked my admin area. Little did I know it was this plugin that did it, till I ended up removing my installation, reinstalling, restoring from a DB backup, and then installing this plugin again. Even a visit to the dev's website didn't reveal anything that would've tipped me off. It took visiting the forums here before I put 2+2 together, renamed the plugin directory, and finally regained access.
=====================
Clients updating their sites as advised found themselves locked out of admin even without having changed the wp-admin login url in Hide Backend.

I had to delete the plugin via ftp and also (thanks to a forum post) the folder wp-content/uploads/ithemes-security; run WP-Cleanup; re-install the pre-iThemes version of the plugin, activate, deactivate and uninstall it; then install and activate the latest iThemes version 4.0.5 on every site....

This used to be a 5* plugin. I use iThemes BackupBuddy all the time (Developer) and recommend it. I was looking to invest in the developer edition of iThemes Security Pro but this has seriously put me off.

I can't believe this issue did not flag in testing given the number of people affected by the update issue.
=====================
Good Lord, people. Don't you ever test your plugins before announcing an upgrade?

Locked out of my own site because your plugin failed? Now only the hackers can get in. Nice.

Not trusting you with my security again.
=====================
It's not the first time I've been locked out of my admin area by 'Better' WP Security. But it is the last. I've finally got back in and the first thing I did was delete your plugin.
=====================
It's unfortunate that I did not read the reviews of the update to the "NEW" iThemes Security v4.x from Better WP Security 3.x. I would have avoided the headache and time invested back leveling the plugin.

It's obvious iThemes wants the new 4.x plugin to ride on the success of the BWS 3.x plugin even though they say it's a total rewrite, a bit misleading to not let the new plugin develop it's own reputation. I rate this new plugin a 0 despite the lowest rating available of 1.
=====================