Someone trying to hack my site!

[deepblack]

Can someone please tell me what to do?

Wordfence tells me for the last 2 hours that a user with hostname mx.eureka.sg is trying to login to my WP site. The exact IP is also given.

What can I do now?

 

[Godziwa]

If you are using wordpress, download something called login lockdown.

 

[Wilson Grant Fisk]

Can someone please tell me what to do?

Wordfence tells me for the last 2 hours that a user with hostname mx.eureka.sg is trying to login to my WP site. The exact IP is also given.

What can I do now?

You can use Wordfence to block the IP or add these plugins and the problem will be fixed:

http://wordpress.org/plugins/stealth-login-page/
http://wordpress.org/plugins/rename-wp-login/

Also Cloudflare blocks a lot of bad bots etc
http://wordpress.org/plugins/cloudflare/

 

[Zevoltai]

My solution to this was to redirect to goatse after 5 failed logins

 

[Ripster]

There are many security plugins and methods that you can use to secure your Wordpress blog. Also makes sure that all of your plugins and software are up to date.

 

[Godziwa]

My solution to this was to redirect to goatse after 5 failed logins

OMG WHY!?? I searched for what a goatse was and the pictures was not amusing to look at.

 

[Oukast]

OMG WHY!?? I searched for what a goatse was and the pictures was not amusing to look at.

The hell do you mean "why"? You'd rather let them pound on your login page?

 

[Zevoltai]

OMG WHY!?? I searched for what a goatse was and the pictures was not amusing to look at.

It definitely stopped the russian guy that was trying to guess my admin password for a week straight

 

[spmcnerd]

Configure Wordfence options.

 

[hookzinder]

You need a security plugin, there are many both free and paid for wordpress. Implement one of them and you should be fine.

 

[V]

Rename your wp-login.php file to something like wp-login.xxx using file manager or ftp, and rename it back to the original name only when you login. I was getting a lot of similar attacks on my site (I have wordfence and login lockdown) and it was annoying, plus someone hacked my site once and logged into it. So I made sure that even if he hacks my WP site, he won't be able to login. Also, I have enabled email notification when someone logs into my site.
Hope it helps.

 

[Automation247]

Welcome to Wordpress!

 

[Nicheblogger]

OMG WHY!?? I searched for what a goatse was and the pictures was not amusing to look at.

Mom: What did you learn in school today?

liljohnny: O jee whiz mom, I learned all sorts of stuff, like what a goatse is and why I shouldnt try to brute force attack a blog unless I am prepared to look at a spread asshole.

 

[zenlagor]

use .htaccess to only allow from your IP for the admin area.

 

[tnhomestead]

Go get HC Custom Wp-Admin, it lets you change your wordpress login for the admin to something only you know. Its hard to hack into a site when you dont have the login address! LOL Never use nulled themes or plugins, lots of them are hacked. I do l2 invalid logins and block the ip for 96 hours + custom HC. No one has ever found the login name to use. Dont use admin or administration for a user name. Always make something up! Then they have to guess 2 words not 1! Also dont use your admin name to post articles with, setup a separate login, that way they cant guess your admin username -- hope these suggestions help!

 

[maecenas23]

There are some very good advices ( and funny ones) here.
I am using Ithemes wordpress security ( the former wordpress better security) and if you set all things correctly, you shouldn't have many issues. The bots try, they get banned, try again they get banned and so on.

The plugin will also help you to change the database name, user name and other things which are usually used to break the security of the WP.
Also, make sure you don't use any theme which was updated 4 years ago.

 

[InsanelySane]

Limit login attempts plugin, set it to 2 tries.

Change username if its admin

 

[koolkake]

he is likely using a run of the mill bruteforcer. Make sure your password is extemely strong and passes password complexity tests. Its probably an auto mass program. He will go to a new site and wont waste time with yours. Prolly just guessed a few default passwords and moved on.

 

[natsirtdm]

I've always found renaming the admin account to be a great deterrent - as long as you use a plugin for custom author names or something it works very well.

 

[Deleted member 731332]

This is a super easy fix, don't freak. If you ever run your own server, you will find that people try to brute force more than just ACP's. I used to get all kinds of brute force attempts before I locked down everything in WHM. It's just part of the game, I wouldn't take it personal.

Be sure to move your admin login to a new directory or slug (whatever you prefer to call it). Always use REALLY strong passwords, no matter what it is. SQL, ACP, email, EVERYTHING.