Wordpress - wp-login.php Attemps

P

Piotr__11

Junior Member
Joined
Mar 13, 2012
Messages
122
Reaction score
69
Hello.
Some time ago I noticed that my wp site gots hundreds of wp-login visits > probably smb is trying to hack it.
I decided to install some captcha plugins - firstly you need to solve some math captcha and then you need to solve normal captcha before you can login. It was around month ago but it didn't help .
Every day in WassUp I see lots of wp-login 'visits' ...
It is annoying, I have user 'admin' but he can't now brute force my password because of captchas .
How can I "cut off" the traffic ? I cannot even see normal statistics - they are faked...
He uses many ips .

Thanks
 
Advertise on BHW
IMpossible said:
I will implement this! Do you have any other wordpress security tips? And do you know how to make the /wp-content folder private so that only I and not others can access it?
Click to expand...

Another tip would be Wordfence, I should have included it in the original reply to OP.
There probably is a link to how to use it on the forum but I had no problems figuring it out. It is also recommended by other members.

Better WP Security has an option to change your WP content folder, not sure if this makes it private.

The two plugins overlap in functions but don't seem to collide. Then again, I am just a nooby so perhaps I should have stressed it more. lol
But, with this you can restore when hacked, notice you are hacked, identify hacking attempts and secure your WP.

Hope this helps. :)
 
Check your logs and block IP ranges. Lets say you have the 188.123.456.789 and another one like 182.321.654.65 IP's trying to break your login, so block the whole range like this 188.123.456.* and 182.321.654.* . Also the majority of attacks come from China and Eastern Europe, so you might wanna block the whole IP range from those countries.

Also use a Login Limit plugin to block access to that host after a determined amount of login attempts.
 
Just chnge the URL for the admin login page.
 
you can also set an authbasic password in .htaccess (it depends on your hosting provider) and you will have another level of security before hitting login screen.
I would start with whitelisting your ip and blocking all the others though.
D.
 
dbyrn said:
you can also set an authbasic password in .htaccess (it depends on your hosting provider) and you will have another level of security before hitting login screen.
I would start with whitelisting your ip and blocking all the others though.
D.
Click to expand...

Yeah that's good for a start.
 
IMpossible said:
Can you easily change it without destroying your site?
Click to expand...

Better WP Security has a tab to hide the backend. :)
I would be careful though, after forgetting my new login slug I had no way in. Had to reinstall. lolz
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top