Someone trying to hack my site!
- Thread starter deepblack
- Start date
Wilson Grant Fisk
Elite Member
- Nov 10, 2012
- 15,677
- 46,847
You can use Wordfence to block the IP or add these plugins and the problem will be fixed:
http://wordpress.org/plugins/stealth-login-page/
http://wordpress.org/plugins/rename-wp-login/
Also Cloudflare blocks a lot of bad bots etc
http://wordpress.org/plugins/cloudflare/
Godziwa
Regular Member
- Jun 18, 2014
- 454
- 226
OMG WHY!?? I searched for what a goatse was and the pictures was not amusing to look at.
Oukast
Senior Member
- Jan 11, 2012
- 833
- 688
The hell do you mean "why"? You'd rather let them pound on your login page?
Zevoltai
Senior Member
- Jul 29, 2013
- 1,004
- 350
It definitely stopped the russian guy that was trying to guess my admin password for a week straight
hookzinder
Newbie
- May 15, 2014
- 7
- 1
You need a security plugin, there are many both free and paid for wordpress. Implement one of them and you should be fine.
- May 18, 2012
- 7,636
- 7,502
Rename your wp-login.php file to something like wp-login.xxx using file manager or ftp, and rename it back to the original name only when you login. I was getting a lot of similar attacks on my site (I have wordfence and login lockdown) and it was annoying, plus someone hacked my site once and logged into it. So I made sure that even if he hacks my WP site, he won't be able to login. Also, I have enabled email notification when someone logs into my site. 
Hope it helps.
Hope it helps.
Automation247
Regular Member
- Jan 21, 2014
- 485
- 196
Welcome to Wordpress!
Nicheblogger
Regular Member
- Apr 29, 2014
- 290
- 194
Mom: What did you learn in school today?
liljohnny: O jee whiz mom, I learned all sorts of stuff, like what a goatse is and why I shouldnt try to brute force attack a blog unless I am prepared to look at a spread asshole.
tnhomestead
Regular Member
- Oct 9, 2011
- 385
- 254
Go get HC Custom Wp-Admin, it lets you change your wordpress login for the admin to something only you know. Its hard to hack into a site when you dont have the login address! LOL Never use nulled themes or plugins, lots of them are hacked. I do l2 invalid logins and block the ip for 96 hours + custom HC. No one has ever found the login name to use. Dont use admin or administration for a user name. Always make something up! Then they have to guess 2 words not 1! Also dont use your admin name to post articles with, setup a separate login, that way they cant guess your admin username -- hope these suggestions help!
maecenas23
Senior Member
- Oct 12, 2010
- 1,075
- 1,010
There are some very good advices ( and funny ones) here.
I am using Ithemes wordpress security ( the former wordpress better security) and if you set all things correctly, you shouldn't have many issues. The bots try, they get banned, try again they get banned and so on.
The plugin will also help you to change the database name, user name and other things which are usually used to break the security of the WP.
Also, make sure you don't use any theme which was updated 4 years ago.
I am using Ithemes wordpress security ( the former wordpress better security) and if you set all things correctly, you shouldn't have many issues. The bots try, they get banned, try again they get banned and so on.
The plugin will also help you to change the database name, user name and other things which are usually used to break the security of the WP.
Also, make sure you don't use any theme which was updated 4 years ago.
InsanelySane
Power Member
- Nov 23, 2013
- 574
- 116
Limit login attempts plugin, set it to 2 tries.
Change username if its admin
Change username if its admin
koolkake
Regular Member
- Jul 2, 2014
- 250
- 237
he is likely using a run of the mill bruteforcer. Make sure your password is extemely strong and passes password complexity tests. Its probably an auto mass program. He will go to a new site and wont waste time with yours. Prolly just guessed a few default passwords and moved on.
D
Deleted member 731332
Guest
This is a super easy fix, don't freak. If you ever run your own server, you will find that people try to brute force more than just ACP's. I used to get all kinds of brute force attempts before I locked down everything in WHM. It's just part of the game, I wouldn't take it personal.
Be sure to move your admin login to a new directory or slug (whatever you prefer to call it). Always use REALLY strong passwords, no matter what it is. SQL, ACP, email, EVERYTHING.
Be sure to move your admin login to a new directory or slug (whatever you prefer to call it). Always use REALLY strong passwords, no matter what it is. SQL, ACP, email, EVERYTHING.