Someone tried to hack my site

Some douchebag tried to hack into my website yesterday. No idea why.

I woke up this morning to like a 100 messages from my host stating certain IP's have been blocked due to too many bad attempts.



Looks like it was a bruteforce attack.

I currently use iThemes Security to protect and backup my site. What more steps should I take to prevent anyone from accessing my site.

Just don't want to take any chances

EDIT- Is there a way I could reverse track this dude?

Just have a good password and keep your theme and plugins up to date. There are always brute force bots hitting my wp-login.php file. Nothing else much you can do. Bad guys probably using TOR or VPNs.

I don't know much about the iThemes security. That is pretty cool. There are also plugins that put a captcha on the login. I rename my wp-loging.php when I am not using it. But I still see bots trying and even on my sites without wordpress the bots are hitting that file.

If you don't have experience and understanding of concepts in how this hacking thing works there is not much you can do besides using strong(long) passwords.

You could contact iThemes Security and ask for a two step login (like the banks use for the login of their clients in e-banking)

First a regular login with password then another password that you get from a sms, mail etc...

Calmly69 said:

No idea why.

Click to expand...

Mostly to obtain links from your site; for personal use and to sell on sites such as sape

Calmly69 said:

Is there a way I could reverse track this dude?

Click to expand...

No, I do not think so

plus database might contain some nice email list

Calmly69 said:

Some douchebag tried to hack into my website yesterday. No idea why.

I woke up this morning to like a 100 messages from my host stating certain IP's have been blocked due to too many bad attempts.

View attachment 70960

Looks like it was a bruteforce attack.

I currently use iThemes Security to protect and backup my site. What more steps should I take to prevent anyone from accessing my site.

Just don't want to take any chances

EDIT- Is there a way I could reverse track this dude?

Click to expand...

You need to have Cloud Flare on all of your sites that you care about.

why not try this stuff as explained at http://www.wpbeginner.com/wp-tutori...tect-your-wordpress-admin-wp-admin-directory/

I get that all day it's so dam anoying. Hopfully it's just doing a run through some sites and it will stop.

Install this plugin https://wordpress.org/plugins/wordfence/
and in the settings tab go to the Login security options and do this:

Select this 3 options
[TABLE="class: wfConfigForm"]
[TR]
[TH]Don't let WordPress reveal valid users in login errors[/TH]
[TD][/TD]
[/TR]
[TR]
[TH]Prevent users registering 'admin' username if it doesn't exist[/TH]
[TD][/TD]
[/TR]
[TR]
[TH]Prevent discovery of usernames through '/?author=N' scans[/TH]
[/TR]
[/TABLE]

Also
[TABLE="class: wfConfigForm"]
[TR]
[TH]Lock out after how many login failures[/TH]
[TD] add 3 times[/TD]
[/TR]
[TR]
[TD] [/TD]
[/TR]
[TR]
[TH]Lock out after how many forgot password attempts[/TH]
[TD] add 3 times[/TD]
[/TR]
[TR]
[TD] [/TD]
[/TR]
[TR]
[TH]Count failures over what time period [/TH]
[TD] 1hour[/TD]
[/TR]
[TR]
[TD] [/TD]
[/TR]
[TR]
[TH]Amount of time a user is locked out 1 hour[/TH]
[/TR]
[/TABLE]

Do this and you will have no problem anymore and make a strong pass.

You should be grateful to that hosting provider

Standard wordpress installations are all the same so attackers look for key things to try to exploit. There are ways to tighten up your wordpress installation using a layered approach.

1. Change the login url for your website. By default it is yoursite/wp-login.php. Attackers just go straight to this url to start their brute-force attack. If they can't find your login then they can't brute-force. Like someone else suggested use iThemes Security. Make it anything you want like yoursite/secretdashboard. Also setup the feature that allows you to lockout a person after too many attempts. Be sure to whitelist your own IP address.

2. Don't use admin as your login name. No matter how strong your password is there is no reason to make things easier by letting them just focus on guessing one field instead of two. There are plugins that allow you to rename the account but you can just create a new admin account with a better name then delete the old one and select the option to transfer all posts to the new admin.

3. Now that you have a new admin account make sure that you use a nickname for your account that is not the same as the account name itself. That way if you create posts using this account to your blog the attackers won't be able to get the name on the new account from your blog posts.

4. Block IP addresses from other countries from accessing your dashboard. In case someone does find the secret url, which is highly unlikely they will get redirected to a url of your choosing. Use can use IQ Block for that.

5. Delete the readme.html file in your WP installation. Hackers can read this file to determine which version of WP you are using which then lets them focus on trying specific exploits as they become available.

6. Let's say someone gets into your site anyway or maybe you gave someone access to your site to do some work for you but you want to know if/when they mess with anything beyond what you told them to do. You can track which files have been altered by using the Sucuri Security Auditing plugin. You will receive emails anytime a file is altered. You can also set it to send you emails for anytime someone logs in or tries to login (also showing which user/password they tried).

With these things in place it's still possible for an attacker to bombard your yoursite/wp-login.php and eat up your bandwidth. So if you setup all of the above and you are still getting messed with you may want to look into getting a firewall like cloudflare.

Trust me, this won't be the last attack.

Looks like it's doing the job, lower the amount of attempts before lockout maybe.

I want to learn how can i hack website

zoom5 said:

1. Change the login url for your website. By default it is yoursite/wp-login.php. Attackers just go straight to this url to start their brute-force attack. If they can't find your login then they can't brute-force. Like someone else suggested use iThemes Security. Make it anything you want like yoursite/secretdashboard. Also setup the feature that allows you to lockout a person after too many attempts. Be sure to whitelist your own IP address.

Click to expand...

Excellent advice!

Here's a plugin that can rename the login page for you, OP.
https://wordpress.org/plugins/rename-wp-login/

Someones really want to get yor website. Previous comment is very useful for you in this situation.