Pretty Sure Someone is Trying to Hack Me

[TribeGal]

Okay, so I looked at my stats and two different IPs viewed my login page over 1200 times in one day. Both IPs were adding a .php on the end of the URL of my login page, but it redirects to a 404error when I tried it.

I looked on my site under admins, the site source, etc. and it doesn't appear that they got in, but I'm a novice so I don't know what else to check. I have one security plug-in installed, and a very strong password, but what other things should I do to increase security?

I find it ironic that this happened after I just posted that someone kept trying to viewing my robots.txt.

ETA: I edited to say that prior to this 1200+ view day, I've been average 25 to 30ish views a day, so I know something is up.

 

[Virus1]

Block those ips.

 

[flexnds]

Could try this in your .htaccess in your root. This will only allow access to your login page from your ip. just fill in the x's with your ip. It will take them to a special page...

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

<Files wp-login.php>
Order Deny,Allow
Deny from all
Allow from xx.x.xxx.xx
</Files>

#custom error docs
ErrorDocument 403 http://chan.jeffreybosman.com/src/127662775139.gif

I would also install "secure wordpress" plugin and "WSD Security". Do a scan and it will let you know what permissions should be changed and analyze your site. There are also tons of step by step tutorials out there. But wsd will inform you to add a .htacces to your wp-admin directory to prevent browsing, proper file permssions on wp-config.php and many other things, so you should be good. Sounds like they are trying to do an sql injection so you could also install some block bad query plugins which secure wordpress does as well.

 

[justin]

Yes, you can block thoso IPs.

 

[flexnds]

trying to block all the ip's is not a good idea as they are probably just going to switch to another proxy. Best to only allow your IP to the login page.

 

[TribeGal]

Thank you so much for this reply, flexnds, and everyone else! I have had BBQ and WSD Security installed for awhile. I have all of the proper settings set in WSD, so I suppose that is why they weren't successful. As far as my .htaccess file, I have everything similar to yours except this part:

<Files wp-login.php>
Order Deny,Allow
Deny from all
Allow from xx.x.xxx.xx
</Files>

I don't think this would work as I am using broadband internet, so my ip is dynamic. Would it still be okay if I left that part out?

 

[flexnds]

Thank you so much for this reply, flexnds, and everyone else! I have had BBQ and WSD Security installed for awhile. I have all of the proper settings set in WSD, so I suppose that is why they weren't successful. As far as my .htaccess file, I have everything similar to yours except this part:

<Files wp-login.php>
Order Deny,Allow
Deny from all
Allow from xx.x.xxx.xx
</Files>

I don't think this would work as I am using broadband internet, so my ip is dynamic. Would it still be okay if I left that part out?

well, I guess it's up to you if you want to have to change your .htaccess everytime your IP changes.

 

[TribeGal]

well, I guess it's up to you if you want to have to change your .htaccess everytime your IP changes.

Well that wouldn't make much sense.

 

[procam]

I think those plugins mentioned by flexnds is your best option at this point. You should still block those IP's. There is also a block proxies plugin somewhere on the net I saw a while back.

All the best!

 

[Bloghat]

Is there a way to allow only ips of a certain range? that way they'd need a proxy of your city/state...? Would reduce the risk and you could do it with dynamic IP.

 

[flexnds]

Is there a way to allow only ips of a certain range? that way they'd need a proxy of your city/state...? Would reduce the risk and you could do it with dynamic IP.

Ya, you can use wildcards. So if you IP does not change by much, that is a possibility.