S2Term
Junior Member
- May 6, 2014
- 172
- 63
I never really worried about hackers getting into my sites because they were small. Until I discovered one of my abandoned sites was completely replaced by an affiliate health site. I was fucking pissed. My password sucked and admin username was published on an article, I was lazy but still, fuck off.
Installing a limit login attempts restricted access but I still kept getting brute force attacks. WordFence worked OK, but was kind of confusing. So after some searching I found a couple of .htaccess recommendations and put them together. This was put up 2 days ago and I've had no hacker traffic. So it looks like it's working. First I'm not a coder, these are just thing I pulled together that seemed to work. If anybody has criticisms, you're probably right and I'd love to hear further recommendations.
The #Begin WordPress part sends traffic to an error page. I put in my entire URL and it works or you could use it as listed in the example.
The next part checks on incoming IP's. So if you IP is not 111.111.111.111 or 222.222.222.222 and you try to get to the admin folder or the admin login page you are directed to the error files. You can add IP's if you login from more than a couple of IP's.
After implementing this I was still getting lockouts and brute force attempts. Some searching led me to the last part, XML RPC. For a lot of my sites I don't use XML RPC, but there will be a lot of plugins that do. So this might not work if you're using JetPack or other plugins.
Add this to your current .htaccess file and put it in the root folder of your site.
Installing a limit login attempts restricted access but I still kept getting brute force attacks. WordFence worked OK, but was kind of confusing. So after some searching I found a couple of .htaccess recommendations and put them together. This was put up 2 days ago and I've had no hacker traffic. So it looks like it's working. First I'm not a coder, these are just thing I pulled together that seemed to work. If anybody has criticisms, you're probably right and I'd love to hear further recommendations.
The #Begin WordPress part sends traffic to an error page. I put in my entire URL and it works or you could use it as listed in the example.
The next part checks on incoming IP's. So if you IP is not 111.111.111.111 or 222.222.222.222 and you try to get to the admin folder or the admin login page you are directed to the error files. You can add IP's if you login from more than a couple of IP's.
After implementing this I was still getting lockouts and brute force attempts. Some searching led me to the last part, XML RPC. For a lot of my sites I don't use XML RPC, but there will be a lot of plugins that do. So this might not work if you're using JetPack or other plugins.
Code:
# BEGIN WordPress
ErrorDocument 401 /error401.php
ErrorDocument 403 /error403.php
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^111.111.111.111$
RewriteCond %{REMOTE_ADDR} !^222.222.222.222$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule>
<IfModule mod_setenvif.c>
<Files xmlrpc.php>
BrowserMatch "Poster" allowed
BrowserMatch "WordPress" allowed
BrowserMatch "Windows Live Writer" allowed
BrowserMatch "wp-iphone" allowed
BrowserMatch "wp-android" allowed
BrowserMatch "wp-windowsphone" allowed
Order Deny,Allow
Deny from All
Allow from env=allowed
</Files>
</IfModule>Add this to your current .htaccess file and put it in the root folder of your site.
for that I use Wordfence or iThemes Security, with any of these you will be way safer
