How do I stop WordPress brute force bots? Need help!!

HustleHardNow

HustleHardNow

Regular Member
Joined
Jun 30, 2017
Messages
290
Reaction score
60
One of my WordPress sites has been getting flooded by bots trying to brute force into my /wp-login.php page for over 2 days now. They haven't been able to do so yet because I have the WordFence plug-in installed that has a firewall which has been blocking failed login attempts right as they happen but this is not stopping them from trying.

I also used the Hide my WP plug-in to change the /wp-login.php page to a different URL so every time someone visits the /wp-login.php page it leads to a 404 page, but the bot requests to that page have continued.

Is there anything I can do to curtail this bot flood? I was thinking of either purchasing the premium version of WordFence because it has a built-in IP blacklist, or even changing my DNS to Cloudflare and letting Cloudflare do it's job.

Would either one of those ideas actually clamp down on these bot hits or is there something else that could be done to stop this?

Any help is appreciated!
 
Advertise on BHW
yes, cloudflare should solve your problem.
their free plan also included "unmetered DDoS protection"..

brute Force is hard to stop, I've done some wp brute Force before, and i can always use rotating proxy to prevent such IP blocking.

blocking access to wp-login.php also not gonna stop the brute Force attack since the attacker could also use xmlrpc.php file on your site.

if you really want secure access to your wp-admin, you could block all IP from accessing that directory using htaccess, and only allow your IP ( or your private proxy) to access that directory.
 
HustleHardNow said:
If I use their free monthly plan, would that be sufficient enough to stop this or would I need to upgrade to one of their paid plans?
Click to expand...
goto cloudflare, add domain and dns. use firewall, turn "security level" to "i'm under attack". its there in free plan
 
xyx3r said:
if you really want secure access to your wp-admin, you could block all IP from accessing that directory using htaccess, and only allow your IP ( or your private proxy) to access that directory.
Click to expand...

Would you mind explaining to me how exactly this is done. I would definitely do this but don't know how exactly it is done.
 
You can block all those ranges of IPs, check on your Wordfence if this is a Chinese, Russian, Arabic or whatever attack.
This happend with me with a yandex bot, it was a hard time until I blocked IP ranges from those countries.
 
Why don’t you just set up a htaccess rule that allows only your IP to wp-login.php ?
 
dreadpixel said:
You can block all those ranges of IPs, check on your Wordfence if this is a Chinese, Russian, Arabic or whatever attack.
This happend with me with a yandex bot, it was a hard time until I blocked IP ranges from those countries.
Click to expand...

The attacks are coming from all over the world. It's not just one set of countries and a few IP ranges but worldwide random IPs.

Diplomat said:
Why don’t you just set up a htaccess rule that allows only your IP to wp-login.php ?
Click to expand...

Because I don't know how to do that. Any help on doing it would be appreciated!!
 
HustleHardNow said:
One of my WordPress sites has been getting flooded by bots trying to brute force into my /wp-login.php page for over 2 days now. They haven't been able to do so yet because I have the WordFence plug-in installed that has a firewall which has been blocking failed login attempts right as they happen but this is not stopping them from trying.

I also used the Hide my WP plug-in to change the /wp-login.php page to a different URL so every time someone visits the /wp-login.php page it leads to a 404 page, but the bot requests to that page have continued.

Is there anything I can do to curtail this bot flood? I was thinking of either purchasing the premium version of WordFence because it has a built-in IP blacklist, or even changing my DNS to Cloudflare and letting Cloudflare do it's job.

Would either one of those ideas actually clamp down on these bot hits or is there something else that could be done to stop this?

Any help is appreciated!
Click to expand...
i have not seeing any helpful comment here so i'm going to tell you this, https://wordpress.org/plugins/custom-login-url/ change the login url to whatever else your like, i bet that you still have the regular login url, change it and it will fix your problem, it fixed mine, gl
 
blacksharks said:
i have not seeing any helpful comment here so i'm going to tell you this, https://wordpress.org/plugins/custom-login-url/ change the login url to whatever else your like, i bet that you still have the regular login url, change it and it will fix your problem, it fixed mine, gl
Click to expand...

I did that already, but I've seen a few bots being able to find the new URL. I am not sure how they do it but changing the login URL hasn't helped me much.
 
HustleHardNow said:
I did that already, but I've seen a few bots being able to find the new URL. I am not sure how they do it but changing the login URL hasn't helped me much.
Click to expand...

Try that htaccess method I sent. It won’t block the attack but it will display a forbidden page to those bots and it’s super easy for your server to handle. It’s one of the best ways to protect yourself besides actually managing a real firewall.. not the WP one. Or if you manage that server and have access to SSH, try out fail2ban and mod security
 
Diplomat said:
Try that htaccess method I sent. It won’t block the attack but it will display a forbidden page to those bots and it’s super easy for your server to handle. It’s one of the best ways to protect yourself besides actually managing a real firewall.. not the WP one. Or if you manage that server and have access to SSH, try out fail2ban and mod security
Click to expand...

Thanks for sending me the link to the htaccess method. I am going to use it right now and see how it goes.

About the firewall, my site is on a VPS that I manage myself but it has no firewall as of right now. I am not sure about SSH access, but if I contact my web host and tell them about fail2ban and mod security, would they be able to help me out with setting it up?

And what else should I do to make sure that both my VPS and website are secured?


Calithran said:
https://en-gb.wordpress.org/plugins/block-wp-login/

I use this plugin when I had the same problem as yours. Maybe it could help. Yes, it will change the wp login to any random login URL, but it does more, such as disabling xmlrpc.php, admin-ajax.php, inserting secret codes into the .htaccess file.
Click to expand...

Thanks for the link but I already have a plug-in that does all that, but I feel that these plugins aren't that helpful for the most part.
 
Last edited:
Well, if you have managed plan then sure, they can help you and I’m pretty sure they have no issues installing those for you. Those 2 should be good enough for the beginning.
 
HustleHardNow said:
Would you mind explaining to me how exactly this is done. I would definitely do this but don't know how exactly it is done.
Click to expand...

Diplomat said:
Why don’t you just set up a htaccess rule that allows only your IP to wp-login.php ?
Click to expand...

Diplomat said:
Have you tried googling it?

https://www.inmotionhosting.com/sup...lock-down-wordpress-admin-login-with-htaccess
Click to expand...
^
yup, this will do.

also, if you don't really need that xmlrpc, just delete it.


*edit reason: wrong quote.
 
free cloudflare can do it. you just need to set rules that whenever this login url is accessed, it will treat it as if there is an ongoing DDOS attack. here's how

in the cloudflare dashboard go to: Page Rules > Create Page Rule

In the If the URL matches, type:

https://*example.com/wp-login.php* (or if you have custom url, put it here)

Turn on Browser Integrity Check
Set Security Level to I'm Under Attack

and that's it...
 
The best way is to use a plugin that make you do a capcha before redirecting to the signin wp page .

slows it down .

you can even be smarter , ask for a number then redrect to a capcha , then rederect to
wp login.


works always.
 
Last edited by a moderator:
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top