My wordpress site is under brute force attack

kpoolisbad

kpoolisbad

Registered Member
Joined
Jan 26, 2023
Messages
72
Reaction score
70
At first, massive login attempts made my site loaded so slow, eventually failed to establish connection to the database.
I have tried the following method but not helping:

1.Plugin - wordfrence
2,Plugin - loginizer
3.Hide my admin login URL
4.Cloudflare under attack mode

I am now denied all the traffic except my IP, once I open my site to public, it goes failed to establish connection to the database within 5 mins.
I am really disapperate, any recommendations? Should I change my hosting? I am using TMD hosting now, and I am running a porn tube website.
If any wordpress secruity professional can offer help I will be glad and pay for services.

Many thanks and god bless all the webmasters.
 
Advertise on BHW
are you sure you're under brute force? what evidence do you have to support that?
failed to establish connection to the database is the most common error on WP. and rarely is it because of brute force.
with all the actions you're taking, it's even less likely for me to think this is brute force related.
likely your WP db is simply fucked up. as most of them.
pay WP expert to fix this for you...maybe someone nice here will look at it for free if you give them your admin login + cpanel login.
usually u can just nuke it, reinstall db, re-import your database. fix it. could be bad theme/plugin causing it. expect to kill a few hours (or days) of your life chasing it.
 
Change loginizer setting to only 2 retries and make the reset like 9999999 hours

Use wps hide login I dont remember the name but it changes the wp-admin to something else.

and cloudflare for finish and you are good to go.

If you still get the problem maybe the server cant handle your site anymore. Did you change something lately or activated some automatic plugins? That could have caused the error in your site. If its a brute force it will show in loginizer
 
uncutu said:
are you sure you're under brute force? what evidence do you have to support that?
failed to establish connection to the database is the most common error on WP. and rarely is it because of brute force.
with all the actions you're taking, it's even less likely for me to think this is brute force related.
likely your WP db is simply fucked up. as most of them.
pay WP expert to fix this for you...maybe someone nice here will look at it for free if you give them your admin login + cpanel login.
usually u can just nuke it, reinstall db, re-import your database. fix it. could be bad theme/plugin causing it. expect to kill a few hours (or days) of your life chasing it.
Click to expand...
Thanks for your reply.
My server side told me I am under brute attack, I have nuke my wordpress and install nothing but template, the data base connection error still occur.
I dont mind burn my site to the ground and rebuild it, it takes no time since I can import all my blog.
 
God of Porn said:
Change loginizer setting to only 2 retries and make the reset like 9999999 hours

Use wps hide login I dont remember the name but it changes the wp-admin to something else.

and cloudflare for finish and you are good to go.

If you still get the problem maybe the server cant handle your site anymore. Did you change something lately or activated some automatic plugins? That could have caused the error in your site. If its a brute force it will show in log
inizer
Click to expand...
Thanks for the reply.
I honestly has tried all the mehods including what you mentioned.
 
You make it sound like your website is hosted in Ukraine...Just kill the poer switch for couple hours..
 
Maybe they have your direct IP, meaning that they could be bypassing cloudflare. Id change the server to a new IP and put it in cloudflare straight away. Would have to check if there’s any NS record or anything leaking your real server IP. Did you deny all traffic except your IP on cloudflare or on your server itself?
 
if your server side told you youre under attack you should be able to tell the range of IP's that are attacking u. then block them.
or consider upgrading to another server.
 
uncutu said:
if your server side told you youre under attack you should be able to tell the range of IP's that are attacking u. then block them.
or consider upgrading to another server.
Click to expand...
I am not sure, I thought brute attack should be more massive, my server side send me this and said it was brute force attack.
 

Attachments

  • 21.png
    21.png
    25.7 KB · Views: 23
TiagoS said:
Maybe they have your direct IP, meaning that they could be bypassing cloudflare. Id change the server to a new IP and put it in cloudflare straight away. Would have to check if there’s any NS record or anything leaking your real server IP. Did you deny all traffic except your IP on cloudflare or on your server itself?
Click to expand...
Thanks for the reply.
Lets say the by pass my cloudflare, how they managed to get through wordfrence and loginizer.
I am running a daily 5k visitors site, not sure why got picked as target.
 
Use Limit Login Attempts Reloaded.

Also try disable xml-rpc.
It is in Perfmatters if you are using it.

Or you can use a snippet with the following code

Code: 
add_filter('xmlrpc_enabled', '__return_false');

Some fuggers from India emailed me about finding a vulnerability in my website and offered some "help" at the same time I was attacked.
Emailed multiple times.

Once I blocked with the above mentioned, they stop emailing me too. :(

They seem to be using some scripts using the xml rpc exploit.
 
qwe7410 said:
Use Limit Login Attempts Reloaded.

Also try disable xml-rpc.
It is in Perfmatters if you are using it.

Or you can use a snippet with the following code

Code: 
add_filter('xmlrpc_enabled', '__return_false');

Some fuggers from India emailed me about finding a vulnerability in my website and offered some "help" at the same time I was attacked.
Emailed multiple times.

Once I blocked with the above mentioned, they stop emailing me too. :(

They seem to be using some scripts using the xml rpc exploit.
Click to expand...
I do gave my wordpress credentials to a indian in fiverrr :weep:
 
In cloudflare make a WAF rule for JavaScript challenge if URI contains:

/wp-login.php
OR
/wp-admin
OR
comment.php
OR
xmlrpc

that should be all you need to do.
 
As said above, just use a plugin or Cloudflare to block /wp-login.php
 
kpoolisbad said:
Thanks for the reply.
Lets say the by pass my cloudflare, how they managed to get through wordfrence and loginizer.
I am running a daily 5k visitors site, not sure why got picked as target.
Click to expand...
If they are bypassing Cloudflare and have your IP, you should only allow connection to your server from Cloudflare IPs and forbid every other IPs. This way they can't bypass cloudflare anymore. There are plenty of tutorial on the web

The plugins are not the best for security cause they will still takes resources. The best way to stop these attack is using an higher layers like Cloudflare WAF rules
 
Zher0 said:
As said above, just use a plugin or Cloudflare to block /wp-login.php
Click to expand...
I don’t recommend a plug-in. The reason why is cloudflare will stop the bot before it gets to your server to use the servers resources. The plug-in may block the bot from logging in but it won’t stop it from consuming resources. The page still loads
 
Zombie Pop said:
In cloudflare make a WAF rule for JavaScript challenge if URI contains:

/wp-login.php
OR
/wp-admin
OR
comment.php
OR
xmlrpc

that should be all you need to do.
Click to expand...
Thanks for the suggestion.
I just doubt if it is really brute force attack.

I decided to nuke mysql database.
 
Zombie Pop said:
I don’t recommend a plug-in. The reason why is cloudflare will stop the bot before it gets to your server to use the servers resources. The plug-in may block the bot from logging in but it won’t stop it from consuming resources. The page still loads
Click to expand...
You can use the BBQ Pro firewall to stop server using resources to if they gonne directly to the IP, Jeff who built it is an old veteran on WordPress security, also written some nice books on the subject.
 
kpoolisbad said:
Thanks for the suggestion.
I just doubt if it is really brute force attack.

I decided to nuke mysql database.
Click to expand...
Yes your server can be targeted several ways without connecting to a web application firewall. As a webmaster you need to learn how to read your server logs to see what is being accessed and by who or what so that you can effectively mitigate any threat.

cloudflare will only help you with web applications
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top