How do I stop WordPress brute force bots? Need help!!

I would suggest to create a file with a few 100mbytes or 1-3gigabyte of size. As you already moved your wp-login.php rename the fresh created large file to wp-login.php and put it in place.
Guess it won‘t last long ....
 
Advertise on BHW
I've had this problem and used WP Cerber: https://wordpress.org/plugins/wp-cerber/

It changes your login page and if a bot goes to that page it will automatically blacklist that IP down to the C Class.

I think you can also whitelist your IP and lockdown, Citadel Mode, your admin section if too many bots attack.

There are a ton of settings and it's free.
 
Wordpress is actually quite horrible product and it produces ridiculously heavy loads even if it doesn't have super crazy plugins and theme. Adding another plugin to "protect" your WP installation makes everything even worse. Yes, it prevents brute force attack (attackers won't be able to use the login/registration form) but since WP is such a heavy platform, it will increase the load even more because there's another layer of PHP code that visitor needs to go through.

Like another person said, xmlrpc.php is another file that is being used for brute force attacks and if you don't use it then there's really no reason to have it available for public.

What you can do is mess with permissions (so that web server cannot read the file and it produces an error page), use htaccess to redirect traffic away to some other site or just block the request and show 403 page. If you can, use WAF (web application firewall). One free and amazing option is to use mod security which these days reasonable web hosting providers install into their servers. If you have your own server then you should install it too. Mod security comes with OWASP (https://modsecurity.org/crs/) which is a set of rules for mod security for extra protection and it's all free!

During situations like this you want to prevent bots from overloading the server which is why you show them a static page. If you compare 100 requests per second to a static page vs 100 requests to your wp installation that has tons of "protection" plugins.. it's pretty obvious who wins this battle. If you still want to use plugins instead.. try to at least have PHP7.x (it's a lot faster than php5.6+ which is commonly used too).

Htaccess is processed before PHP which is why it's such powerful tool to use. It's not only for overwriting urls and making them pretty :P
 
All suggestions here which blacklist IP on attack will not work as brute force attacks can be done with rotating proxies.
 
Diplomat said:
Have you tried googling it?

https://www.inmotionhosting.com/sup...lock-down-wordpress-admin-login-with-htaccess
Click to expand...
Diplomat said:
Wordpress is actually quite horrible product and it produces ridiculously heavy loads even if it doesn't have super crazy plugins and theme. Adding another plugin to "protect" your WP installation makes everything even worse. Yes, it prevents brute force attack (attackers won't be able to use the login/registration form) but since WP is such a heavy platform, it will increase the load even more because there's another layer of PHP code that visitor needs to go through.

Like another person said, xmlrpc.php is another file that is being used for brute force attacks and if you don't use it then there's really no reason to have it available for public.

What you can do is mess with permissions (so that web server cannot read the file and it produces an error page), use htaccess to redirect traffic away to some other site or just block the request and show 403 page. If you can, use WAF (web application firewall). One free and amazing option is to use mod security which these days reasonable web hosting providers install into their servers. If you have your own server then you should install it too. Mod security comes with OWASP (https://modsecurity.org/crs/) which is a set of rules for mod security for extra protection and it's all free!

During situations like this you want to prevent bots from overloading the server which is why you show them a static page. If you compare 100 requests per second to a static page vs 100 requests to your wp installation that has tons of "protection" plugins.. it's pretty obvious who wins this battle. If you still want to use plugins instead.. try to at least have PHP7.x (it's a lot faster than php5.6+ which is commonly used too).

Htaccess is processed before PHP which is why it's such powerful tool to use. It's not only for overwriting urls and making them pretty :p
Click to expand...


I second this.
completely agree with all of things he stated.
couldn't explain it better.
 
krishnaverma said:
All suggestions here which blacklist IP on attack will not work as brute force attacks can be done with rotating proxies.
Click to expand...

how it is not gonna work if we block ALL the IP Address on the planet????
using htaccess or some sort of firewall that doesn't involve plugin or PHP script?
read the beautiful explanation by @Diplomat above you.
 
Make sure that you set wordfence to immediately block anyone accessing url /xmlrpc.php Once they finally give up use these tools to make sure your setting are adequate to bring the site to 0 vulnerabilities never set a user name to admin, administrator or the nameofsite then set it to immediately block any one trying to login with thous username or any unregistered username. You can put a proxy infuront of the site and dump all DDOS connections accessing the site at X intervals. info on how to access your site:
Code: 
https://www.qualys.com/
https://www.beyondsecurity.com/
https://security.stackexchange.com/questions/6666/accessing-a-site-which-is-under-a-ddos
https://www.google.com/search?&q=how+to+access+at+my+site+while+its+under+DDOS
 
Last edited:
It happened to me earlier.

I use
Code: 
 https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/

and setup everything as required with best settings with Disabling XMLRPC + Renaming login URL + Login Form Captcha + Blocking known usernames (Admin,Administrator,Editor etc..)

alongwith
Code: 
https://wordpress.org/plugins/brute-force-login-protection/
and limit the number of login attempts to 1.

and also with 2FA plugin below

Code: 
https://wordpress.org/plugins/miniorange-2-factor-authentication/

Now everything is working fine.
 
xyx3r said:
how it is not gonna work if we block ALL the IP Address on the planet????
using htaccess or some sort of firewall that doesn't involve plugin or PHP script?
read the beautiful explanation by @Diplomat above you.
Click to expand...
Actually, op needs to take help of an experienced security researcher depending on how important is this project for him. You can read reports related to brute force attacks even after using the suggestions implemented in this thread.
 
krishnaverma said:
Actually, op needs to take help of an experienced security researcher depending on how important is this project for him. You can read reports related to brute force attacks even after using the suggestions implemented in this thread.
Click to expand...

agreed..
just wanted to say that rotating proxy could be stopped using IP blocking. not arguing with you about the importance of security expert to take a look into the matter. and i am in no way claiming to be one.

eternalwarrior said:
change your login url directory. turn yoursite.com/wp-login.php to something else like yoursite.com/fuck-brute-force.php
Click to expand...

the problem here is not only about brute Force to gain access to admin, what concerned TS is that the server load caused by the bruteforce attempt. changing the login page doesn't stop the bruteforce attempt.
 
Here is the best tip: get your web host support to help. They'll deal with those bot. Been there, bought the shirts ;)
 
Be careful if you are trying to protect the wp-admin folder. It might fuck up all of your frontend ajax calls ;) . Do some testing before you call it a day
 
Thanks for the suggestions everyone. I really appreciate all the help that this great forum has to offer!!

I am trying out a lot of the suggestions made in this thread, which is taking me a while to do because I am still a newbie when it comes to website security, but doing my best to learn the ropes as they say.

I'll keep this thread updated on how everything goes. It's just taking me a while to figure this stuff out and apply it to my website. I really appreciate all the help that was given to me.
 
Cloudflare is your best bet.
 
HustleHardNow said:
One of my WordPress sites has been getting flooded by bots trying to brute force into my /wp-login.php page for over 2 days now. They haven't been able to do so yet because I have the WordFence plug-in installed that has a firewall which has been blocking failed login attempts right as they happen but this is not stopping them from trying.

I also used the Hide my WP plug-in to change the /wp-login.php page to a different URL so every time someone visits the /wp-login.php page it leads to a 404 page, but the bot requests to that page have continued.

Is there anything I can do to curtail this bot flood? I was thinking of either purchasing the premium version of WordFence because it has a built-in IP blacklist, or even changing my DNS to Cloudflare and letting Cloudflare do it's job.

Would either one of those ideas actually clamp down on these bot hits or is there something else that could be done to stop this?

Any help is appreciated!
Click to expand...
Simply rename the wp-login file for a very simple solution here.
 
Their are some services which protects from ddos
search them on google and try
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top