[HELP] 40+ hack attempts from Russsian Federation this week

[B. Friendly]

You have posted some excellent info about Brute force attacks and I'll surely read more about it. After discussing the issue with several people I think I am over-reacting but I think (like you said) this 'over-reacting' has gave me some excellent advices from some brilliant helpful users and I learned a lot.

That's a beautiful attitude, and for that you get Rep+.

 

[terebi]

Are you using cloudflare? If not install it immediately. All problems solved!

Wow awesome tip. First time I heard about it. Will sign up thanks.

 

[Gogol]

I have posted some tips myself too in that thread (check them out) and this time I have followed your Tip#6 successfully.

Oh sorry I completely missed that

 

[AnotherOne]

First of all thank you for continuously replying and helping me.
I have cron job to backup and email SQL file daily but I was wondering if there's a free/paid plugin/script that'll backup all my files or at least posts/pages.

EDIT: IMHO you dont need either vps or dedicated servers just sticked to the advices given to you and make sure you have daily backups (not your hosting company) but YOU have the daily backups.

Why ? In most cases your hosting company will take some time to restore it and if u have it at hand you can do it right away if an issue arrives.

Those who helped me, at least deserve some kind words and that's what I did

That's a beautiful attitude, and for that you get Rep+.

 

[0_00_0]

I would ban Russia and china just from /wp-admin. Let them access the rest of your website but don't let them get to the admin section.

 

[AnotherOne]

Why restricting only them to access /wp-admin?
BTW I have restricted everyone to access /wp-admin on my server.

I would ban Russia and china just from /wp-admin. Let them access the rest of your website but don't let them get to the admin section.

 

[starcity83]

This sounds like a Captcha code breaker bot of some type, nothing to worry about.

 

[Dante848]

This is clearly, and I mean clearly a bot. This happens to me all the time, the cPanel on my VPS gets at least 400+ attempts daily. These are not people, they are bots attempting brute force. I switched to SSH and SFTP to stop them from trying, not that they would get in, but I'm sick of the emails from cPanel. If you have a secure pass don't worry about it. Try a dual auth plug-in for WP. These are nothing but bots, ignore them and move on. And make sure you do security checks for your version of WordPress on exploit DB or 1337day. I guarantee at least one of your plug-ins is susceptible to XSS or FPD, or maybe ever SQLi.

 

[tejsin]

mate, if they are after you (you are done)

 

[AnotherOne]

Never heard of that bot before. BTW there's no captcha on login screen and I am sure you know that too

This sounds like a Captcha code breaker bot of some type, nothing to worry about.

I am using a secure password. Any free dual auth enabling plugin(s)? your favorite one?
BTW I'll check those sites you mentioned for security checks of WordPress.

This is clearly, and I mean clearly a bot. This happens to me all the time, the cPanel on my VPS gets at least 400+ attempts daily. These are not people, they are bots attempting brute force. I switched to SSH and SFTP to stop them from trying, not that they would get in, but I'm sick of the emails from cPanel. If you have a secure pass don't worry about it. Try a dual auth plug-in for WP. These are nothing but bots, ignore them and move on. And make sure you do security checks for your version of WordPress on exploit DB or 1337day. I guarantee at least one of your plug-ins is susceptible to XSS or FPD, or maybe ever SQLi.

I am scared. What should I do now?

mate, if they are after you (you are done)

 

[Dante848]

Use this one http://wordpress.org/extend/plugins/duo-wordpress/ it is what I use and allows the use of phone/SMS verification, which I believe is one of the most secure ways to protect a login. People can get your pass, emails, security questions, but they cannot get your phone.

 

[AnotherOne]

The plugin has very *few downloads and it was last updated 10 months ago.

Use this one http://wordpress.org/extend/plugins/duo-wordpress/ it is what I use and allows the use of phone/SMS verification, which I believe is one of the most secure ways to protect a login. People can get your pass, emails, security questions, but they cannot get your phone.

 

[Dante848]

The plugin has very *few downloads and it was last updated 10 months ago.

My bad, wrong one. This is the one I use http://wordpress.org/extend/plugins/google-authenticator/ I stopped using that one when they discontinued support. Sorry about that.

 

[AnotherOne]

Too bad they stopped development of that plugin. The previous one you shared was looking promising.
I have windows mobile and this plugin will only work with Android/iPhone and BB :|

My bad, wrong one. This is the one I use http://wordpress.org/extend/plugins/google-authenticator/ I stopped using that one when they discontinued support. Sorry about that.

 

[garrido]

Use incapsula dot com to protect your site.

 

[blackguy81]

Why restricting only them to access /wp-admin?
BTW I have restricted everyone to access /wp-admin on my server.

Yeah, that's good, but make sure you don't restrict your own IP..lol

 

[AnotherOne]

This is similar to Cloudflare? I have already installed Cloudflare on my website.

Use incapsula dot com to protect your site.

Oh yes! I've double checked that.

Yeah, that's good, but make sure you don't restrict your own IP..lol

 

[B. Friendly]

Are you using cloudflare? If not install it immediately. All problems solved!

What does Cloudflare, a content delivery network, have to do with securing a website against hacking?

 

[cgimaster]

https://www.cloudflare.com/features-security
that speaks for itself

Its not bullet-proof either but its pretty interesting, never had to use it anyway.

 

[AnotherOne]

That's exactly what I wrote above I have installed Cloudflare to give a little boost to my website that's all.
After configuring W3 Total Cache and Cloudflare properly my website's Google Page Speed score is changed to 95/100 and according to Pingdom my website load faster than 93% tested website.

What does Cloudflare, a content delivery network, have to do with securing a website against hacking?

Do you believe in their 'we'll secure your website by doing this and that and that'?

https://www.cloudflare.com/features-security
that speaks for itself

Its not bullet-proof either but its pretty interesting, never had to use it anyway.

EDITED:
Sorry for my ignorance