How do I stop WordPress brute force bots? Need help!!

[HustleHardNow]

One of my WordPress sites has been getting flooded by bots trying to brute force into my /wp-login.php page for over 2 days now. They haven't been able to do so yet because I have the WordFence plug-in installed that has a firewall which has been blocking failed login attempts right as they happen but this is not stopping them from trying.

I also used the Hide my WP plug-in to change the /wp-login.php page to a different URL so every time someone visits the /wp-login.php page it leads to a 404 page, but the bot requests to that page have continued.

Is there anything I can do to curtail this bot flood? I was thinking of either purchasing the premium version of WordFence because it has a built-in IP blacklist, or even changing my DNS to Cloudflare and letting Cloudflare do it's job.

Would either one of those ideas actually clamp down on these bot hits or is there something else that could be done to stop this?

Any help is appreciated!

 

[putin777]

Set Im under DDOS attack on cloudflare

 

[proxified]

cloudflare should solve your purpose

 

[HustleHardNow]

Set Im under DDOS attack on cloudflare

cloudflare should solve your purpose

If I use their free monthly plan, would that be sufficient enough to stop this or would I need to upgrade to one of their paid plans?

 

[xyx3r]

yes, cloudflare should solve your problem.
their free plan also included "unmetered DDoS protection"..

brute Force is hard to stop, I've done some wp brute Force before, and i can always use rotating proxy to prevent such IP blocking.

blocking access to wp-login.php also not gonna stop the brute Force attack since the attacker could also use xmlrpc.php file on your site.

if you really want secure access to your wp-admin, you could block all IP from accessing that directory using htaccess, and only allow your IP ( or your private proxy) to access that directory.

 

[proxified]

If I use their free monthly plan, would that be sufficient enough to stop this or would I need to upgrade to one of their paid plans?

goto cloudflare, add domain and dns. use firewall, turn "security level" to "i'm under attack". its there in free plan

 

[HustleHardNow]

if you really want secure access to your wp-admin, you could block all IP from accessing that directory using htaccess, and only allow your IP ( or your private proxy) to access that directory.

Would you mind explaining to me how exactly this is done. I would definitely do this but don't know how exactly it is done.

 

[dreadpixel]

You can block all those ranges of IPs, check on your Wordfence if this is a Chinese, Russian, Arabic or whatever attack.
This happend with me with a yandex bot, it was a hard time until I blocked IP ranges from those countries.

 

[Diplomat]

Why don’t you just set up a htaccess rule that allows only your IP to wp-login.php ?

 

[HustleHardNow]

You can block all those ranges of IPs, check on your Wordfence if this is a Chinese, Russian, Arabic or whatever attack.
This happend with me with a yandex bot, it was a hard time until I blocked IP ranges from those countries.

The attacks are coming from all over the world. It's not just one set of countries and a few IP ranges but worldwide random IPs.

Why don’t you just set up a htaccess rule that allows only your IP to wp-login.php ?

Because I don't know how to do that. Any help on doing it would be appreciated!!

 

[Diplomat]

Have you tried googling it?

https://www.inmotionhosting.com/sup...lock-down-wordpress-admin-login-with-htaccess

 

[blacksharks]

One of my WordPress sites has been getting flooded by bots trying to brute force into my /wp-login.php page for over 2 days now. They haven't been able to do so yet because I have the WordFence plug-in installed that has a firewall which has been blocking failed login attempts right as they happen but this is not stopping them from trying.

I also used the Hide my WP plug-in to change the /wp-login.php page to a different URL so every time someone visits the /wp-login.php page it leads to a 404 page, but the bot requests to that page have continued.

Is there anything I can do to curtail this bot flood? I was thinking of either purchasing the premium version of WordFence because it has a built-in IP blacklist, or even changing my DNS to Cloudflare and letting Cloudflare do it's job.

Would either one of those ideas actually clamp down on these bot hits or is there something else that could be done to stop this?

Any help is appreciated!

i have not seeing any helpful comment here so i'm going to tell you this, https://wordpress.org/plugins/custom-login-url/ change the login url to whatever else your like, i bet that you still have the regular login url, change it and it will fix your problem, it fixed mine, gl

 

[HustleHardNow]

i have not seeing any helpful comment here so i'm going to tell you this, https://wordpress.org/plugins/custom-login-url/ change the login url to whatever else your like, i bet that you still have the regular login url, change it and it will fix your problem, it fixed mine, gl

I did that already, but I've seen a few bots being able to find the new URL. I am not sure how they do it but changing the login URL hasn't helped me much.

 

[Diplomat]

I did that already, but I've seen a few bots being able to find the new URL. I am not sure how they do it but changing the login URL hasn't helped me much.

Try that htaccess method I sent. It won’t block the attack but it will display a forbidden page to those bots and it’s super easy for your server to handle. It’s one of the best ways to protect yourself besides actually managing a real firewall.. not the WP one. Or if you manage that server and have access to SSH, try out fail2ban and mod security

 

[Calithran]

https://en-gb.wordpress.org/plugins/block-wp-login/

I use this plugin when I had the same problem as yours. Maybe it could help. Yes, it will change the wp login to any random login URL, but it does more, such as disabling xmlrpc.php, admin-ajax.php, inserting secret codes into the .htaccess file.

 

[HustleHardNow]

Try that htaccess method I sent. It won’t block the attack but it will display a forbidden page to those bots and it’s super easy for your server to handle. It’s one of the best ways to protect yourself besides actually managing a real firewall.. not the WP one. Or if you manage that server and have access to SSH, try out fail2ban and mod security

Thanks for sending me the link to the htaccess method. I am going to use it right now and see how it goes.

About the firewall, my site is on a VPS that I manage myself but it has no firewall as of right now. I am not sure about SSH access, but if I contact my web host and tell them about fail2ban and mod security, would they be able to help me out with setting it up?

And what else should I do to make sure that both my VPS and website are secured?

https://en-gb.wordpress.org/plugins/block-wp-login/

I use this plugin when I had the same problem as yours. Maybe it could help. Yes, it will change the wp login to any random login URL, but it does more, such as disabling xmlrpc.php, admin-ajax.php, inserting secret codes into the .htaccess file.

Thanks for the link but I already have a plug-in that does all that, but I feel that these plugins aren't that helpful for the most part.

 

[Diplomat]

Well, if you have managed plan then sure, they can help you and I’m pretty sure they have no issues installing those for you. Those 2 should be good enough for the beginning.

 

[xyx3r]

Would you mind explaining to me how exactly this is done. I would definitely do this but don't know how exactly it is done.

Why don’t you just set up a htaccess rule that allows only your IP to wp-login.php ?

Have you tried googling it?

https://www.inmotionhosting.com/sup...lock-down-wordpress-admin-login-with-htaccess

^
yup, this will do.

also, if you don't really need that xmlrpc, just delete it.


*edit reason: wrong quote.

 

[cocoholo]

free cloudflare can do it. you just need to set rules that whenever this login url is accessed, it will treat it as if there is an ongoing DDOS attack. here's how

in the cloudflare dashboard go to: Page Rules > Create Page Rule

In the If the URL matches, type:

https://*example.com/wp-login.php* (or if you have custom url, put it here)

Turn on Browser Integrity Check
Set Security Level to I'm Under Attack

and that's it...

 

[Deleted member 657006]

The best way is to use a plugin that make you do a capcha before redirecting to the signin wp page .

slows it down .

you can even be smarter , ask for a number then redrect to a capcha , then rederect to
wp login.


works always.