Wordpress - wp-login.php Attemps

[Piotr__11]

Hello.
Some time ago I noticed that my wp site gots hundreds of wp-login visits > probably smb is trying to hack it.
I decided to install some captcha plugins - firstly you need to solve some math captcha and then you need to solve normal captcha before you can login. It was around month ago but it didn't help .
Every day in WassUp I see lots of wp-login 'visits' ...
It is annoying, I have user 'admin' but he can't now brute force my password because of captchas .
How can I "cut off" the traffic ? I cannot even see normal statistics - they are faked...
He uses many ips .

Thanks

 

[Amsterdammer]

Whitelist your ip, block all else.
There is a plugin to double the time needed between logins on each failed attempt.
Block specific IP's

And read this:
http://www.blackhatworld.com/blackh...your-wordpress-website-howto.html#post4494877

 

[IMpossible]

Whitelist your ip, block all else.
There is a plugin to double the time needed between logins on each failed attempt.
Block specific IP's

And read this:
http://www.blackhatworld.com/blackh...your-wordpress-website-howto.html#post4494877

I will implement this! Do you have any other wordpress security tips? And do you know how to make the /wp-content folder private so that only I and not others can access it?

 

[Amsterdammer]

I will implement this! Do you have any other wordpress security tips? And do you know how to make the /wp-content folder private so that only I and not others can access it?

Another tip would be Wordfence, I should have included it in the original reply to OP.
There probably is a link to how to use it on the forum but I had no problems figuring it out. It is also recommended by other members.

Better WP Security has an option to change your WP content folder, not sure if this makes it private.

The two plugins overlap in functions but don't seem to collide. Then again, I am just a nooby so perhaps I should have stressed it more. lol
But, with this you can restore when hacked, notice you are hacked, identify hacking attempts and secure your WP.

Hope this helps.

 

[JCena]

Hope this helps -

http://wordpress.org/extend/plugins/login-security-solution/

 

[carlikito]

Check your logs and block IP ranges. Lets say you have the 188.123.456.789 and another one like 182.321.654.65 IP's trying to break your login, so block the whole range like this 188.123.456.* and 182.321.654.* . Also the majority of attacks come from China and Eastern Europe, so you might wanna block the whole IP range from those countries.

Also use a Login Limit plugin to block access to that host after a determined amount of login attempts.

 

[ChEcKeD]

Just chnge the URL for the admin login page.

 

[IMpossible]

Just chnge the URL for the admin login page.

Can you easily change it without destroying your site?

 

[dbyrn]

you can also set an authbasic password in .htaccess (it depends on your hosting provider) and you will have another level of security before hitting login screen.
I would start with whitelisting your ip and blocking all the others though.
D.

 

[IMpossible]

you can also set an authbasic password in .htaccess (it depends on your hosting provider) and you will have another level of security before hitting login screen.
I would start with whitelisting your ip and blocking all the others though.
D.

Yeah that's good for a start.

 

[Amsterdammer]

Can you easily change it without destroying your site?

Better WP Security has a tab to hide the backend.
I would be careful though, after forgetting my new login slug I had no way in. Had to reinstall. lolz

 

[drkwrld]

Change ur admin folder name n ur username.