[URGENT] Someone is trying to HACK my WP site

Move/Rename Admin Login page, any of these should help:
https://wordpress.org/plugins/rename-wp-login/
https://wordpress.org/plugins/sf-move-login/
https://wordpress.org/plugins/loginizer/
https://wordpress.org/plugins/lockdown-wp-admin/
https://wordpress.org/plugins/wps-hide-login/

If you move/rename the Login page it should stop the bot/hack attempt.

Use https://wordpress.org/plugins/login-recaptcha/ and you can show him the middle finger then.

norkodeo said:

I dont know if someone mentioned this already but you can :
1) Change your WP-admin page address - by default it is http://xxx.com/wp-admin - and you can change it to xxx.com/donaldtrumpneverwins
And I can bet that no one will find this "login" page to massively attack with logins.
2) Its called CLEF - just google for "get clef" - its 2 steps verification with your phone using your phone camera and barcodes - so in this case you can be much more safe and none of Pakistani haxors will take down your site.

Click to expand...

That's it... I changed the login url and it's done. Thnx for the tip and thnx everyone for extending your helping hand.

Have you tried Wordfence? Paid service can block country level IPs
At least for a day or so...

you can try wp limit login attempts and inform your hosting about it so they can take action on this

Right now there is a large scale bot attack going around looking for WP sites to hack. I'm seeing it in the logs for all my sites whether they are WP sites or not. A bot will hit the wp-login page, then it will often hit the home page. Then a few minutes later, the same thing, same user agent (Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1) but different IP. Over and over again, regardless whether it gets a 404 response or not.

So the way to combat this would be to change the name of your login page, there are several plugins that do this.

newon said:

Since last few hours someone is trying hack my WP site. In last 4 hours more than 500 attemps on my login page.
>> I changed password to more harder one
>> I keep blocking IPs .... but he's changing IP frequently
>> I've added IP block for more than 5 missed attempts.

What more should I do... please please please help... It's URGENT

Click to expand...

Install the plugin WordFence and you should be fine.
https://wordpress.org/plugins/wordfence/