My wordpress site is under brute force attack

[kpoolisbad]

At first, massive login attempts made my site loaded so slow, eventually failed to establish connection to the database.
I have tried the following method but not helping:

1.Plugin - wordfrence
2,Plugin - loginizer
3.Hide my admin login URL
4.Cloudflare under attack mode

I am now denied all the traffic except my IP, once I open my site to public, it goes failed to establish connection to the database within 5 mins.
I am really disapperate, any recommendations? Should I change my hosting? I am using TMD hosting now, and I am running a porn tube website.
If any wordpress secruity professional can offer help I will be glad and pay for services.

Many thanks and god bless all the webmasters.

 

[uncutu]

are you sure you're under brute force? what evidence do you have to support that?
failed to establish connection to the database is the most common error on WP. and rarely is it because of brute force.
with all the actions you're taking, it's even less likely for me to think this is brute force related.
likely your WP db is simply fucked up. as most of them.
pay WP expert to fix this for you...maybe someone nice here will look at it for free if you give them your admin login + cpanel login.
usually u can just nuke it, reinstall db, re-import your database. fix it. could be bad theme/plugin causing it. expect to kill a few hours (or days) of your life chasing it.

 

[God of Porn]

Change loginizer setting to only 2 retries and make the reset like 9999999 hours

Use wps hide login I dont remember the name but it changes the wp-admin to something else.

and cloudflare for finish and you are good to go.

If you still get the problem maybe the server cant handle your site anymore. Did you change something lately or activated some automatic plugins? That could have caused the error in your site. If its a brute force it will show in loginizer

 

[kpoolisbad]

are you sure you're under brute force? what evidence do you have to support that?
failed to establish connection to the database is the most common error on WP. and rarely is it because of brute force.
with all the actions you're taking, it's even less likely for me to think this is brute force related.
likely your WP db is simply fucked up. as most of them.
pay WP expert to fix this for you...maybe someone nice here will look at it for free if you give them your admin login + cpanel login.
usually u can just nuke it, reinstall db, re-import your database. fix it. could be bad theme/plugin causing it. expect to kill a few hours (or days) of your life chasing it.

Thanks for your reply.
My server side told me I am under brute attack, I have nuke my wordpress and install nothing but template, the data base connection error still occur.
I dont mind burn my site to the ground and rebuild it, it takes no time since I can import all my blog.

 

[kpoolisbad]

Change loginizer setting to only 2 retries and make the reset like 9999999 hours

Use wps hide login I dont remember the name but it changes the wp-admin to something else.

and cloudflare for finish and you are good to go.

If you still get the problem maybe the server cant handle your site anymore. Did you change something lately or activated some automatic plugins? That could have caused the error in your site. If its a brute force it will show in log
inizer

Thanks for the reply.
I honestly has tried all the mehods including what you mentioned.

 

[The Economist]

You make it sound like your website is hosted in Ukraine...Just kill the poer switch for couple hours..

 

[TiagoS]

Maybe they have your direct IP, meaning that they could be bypassing cloudflare. Id change the server to a new IP and put it in cloudflare straight away. Would have to check if there’s any NS record or anything leaking your real server IP. Did you deny all traffic except your IP on cloudflare or on your server itself?

 

[uncutu]

if your server side told you youre under attack you should be able to tell the range of IP's that are attacking u. then block them.
or consider upgrading to another server.

 

[kpoolisbad]

You make it sound like your website is hosted in Ukraine...Just kill the poer switch for couple hours..

LOL, brute forced me physically

 

[kpoolisbad]

if your server side told you youre under attack you should be able to tell the range of IP's that are attacking u. then block them.
or consider upgrading to another server.

I am not sure, I thought brute attack should be more massive, my server side send me this and said it was brute force attack.

 

[kpoolisbad]

Maybe they have your direct IP, meaning that they could be bypassing cloudflare. Id change the server to a new IP and put it in cloudflare straight away. Would have to check if there’s any NS record or anything leaking your real server IP. Did you deny all traffic except your IP on cloudflare or on your server itself?

Thanks for the reply.
Lets say the by pass my cloudflare, how they managed to get through wordfrence and loginizer.
I am running a daily 5k visitors site, not sure why got picked as target.

 

[qwe7410]

Use Limit Login Attempts Reloaded.

Also try disable xml-rpc.
It is in Perfmatters if you are using it.

Or you can use a snippet with the following code

add_filter('xmlrpc_enabled', '__return_false');

Some fuggers from India emailed me about finding a vulnerability in my website and offered some "help" at the same time I was attacked.
Emailed multiple times.

Once I blocked with the above mentioned, they stop emailing me too.

They seem to be using some scripts using the xml rpc exploit.

 

[kpoolisbad]

Use Limit Login Attempts Reloaded.

Also try disable xml-rpc.
It is in Perfmatters if you are using it.

Or you can use a snippet with the following code

add_filter('xmlrpc_enabled', '__return_false');

Some fuggers from India emailed me about finding a vulnerability in my website and offered some "help" at the same time I was attacked.
Emailed multiple times.

Once I blocked with the above mentioned, they stop emailing me too.

They seem to be using some scripts using the xml rpc exploit.

I do gave my wordpress credentials to a indian in fiverrr

 

[Deleted member 731332]

In cloudflare make a WAF rule for JavaScript challenge if URI contains:

/wp-login.php
OR
/wp-admin
OR
comment.php
OR
xmlrpc

that should be all you need to do.

 

[Zher0]

As said above, just use a plugin or Cloudflare to block /wp-login.php

 

[Ababba2]

Thanks for the reply.
Lets say the by pass my cloudflare, how they managed to get through wordfrence and loginizer.
I am running a daily 5k visitors site, not sure why got picked as target.

If they are bypassing Cloudflare and have your IP, you should only allow connection to your server from Cloudflare IPs and forbid every other IPs. This way they can't bypass cloudflare anymore. There are plenty of tutorial on the web

The plugins are not the best for security cause they will still takes resources. The best way to stop these attack is using an higher layers like Cloudflare WAF rules

 

[Deleted member 731332]

As said above, just use a plugin or Cloudflare to block /wp-login.php

I don’t recommend a plug-in. The reason why is cloudflare will stop the bot before it gets to your server to use the servers resources. The plug-in may block the bot from logging in but it won’t stop it from consuming resources. The page still loads

 

[kpoolisbad]

In cloudflare make a WAF rule for JavaScript challenge if URI contains:

/wp-login.php
OR
/wp-admin
OR
comment.php
OR
xmlrpc

that should be all you need to do.

Thanks for the suggestion.
I just doubt if it is really brute force attack.

I decided to nuke mysql database.

 

[Dopious]

I don’t recommend a plug-in. The reason why is cloudflare will stop the bot before it gets to your server to use the servers resources. The plug-in may block the bot from logging in but it won’t stop it from consuming resources. The page still loads

You can use the BBQ Pro firewall to stop server using resources to if they gonne directly to the IP, Jeff who built it is an old veteran on WordPress security, also written some nice books on the subject.

 

[Deleted member 731332]

Thanks for the suggestion.
I just doubt if it is really brute force attack.

I decided to nuke mysql database.

Yes your server can be targeted several ways without connecting to a web application firewall. As a webmaster you need to learn how to read your server logs to see what is being accessed and by who or what so that you can effectively mitigate any threat.

cloudflare will only help you with web applications