6

On my website, the highest GPU usage is actually on the WordPress login page, not the home page. I have basically come to the conclusion that it is being attacked by a brute force attack, or something similar.

I have installed a plugin that prevents password attacks from bots, but it doesn't prevent the bots from actually visiting the page in the first place.

I want to change the location of the login page to something like wp-login-here.php, or perhaps there is a better solution. The Stealth Plugin seems like it would do the trick, but it is not compatible with recent versions of WordPress. Any ideas?

EDIT: The real solution to this problem was for me to do a clean install of WordPress, this time in a version that was supported by the Stealth plugin. After installing WP and the Stealth plugin on this earlier version of WP, I used the .htaccess file that the plugin created and copied it over (after making a few modifications) to the production site. The reason I accepted the answer I did was because Bad Behavior ended up being a good plugin, and the other advice was useful.

4
  • Is protecting the login page with an additional Apache password an option? It's a bit kludgy if you change computers often (because you'd have to enter two passwords) but would provide additional security
    – Pekka
    Dec 14, 2010 at 21:17
  • I was thinking about that as an option. How would I go about adding a password to a single file though (I've only done it on directories in the past)?
    – epaps
    Dec 14, 2010 at 21:32
  • what's maybe happening is that you don't have that much traffic, and you use to login often? that could be generating the traffic for your login page...?
    – tkit
    Dec 15, 2010 at 7:45
  • No, pootzko, that's not happening. The site does not require a login to view any content.
    – epaps
    Dec 15, 2010 at 18:05

10 Answers 10

7

How would I go about adding a password to a single file?

Add this to WP's current .htaccess:

<FilesMatch "wp-login.php">
    AuthName "WordPress Admin"
    AuthType Basic
    AuthUserFile /path/to/.htpasswd
    require valid-user
</FilesMatch>
1
  • 3
    This solution, while good, will break the user's ability to logout (will pop up the basic auth box) - especially annoying if using woocommerce.... it's annoying how logging out of WordPress utilises the wp-login.php file. Nov 21, 2019 at 0:12
4

bad behavior can block out some known malicious IP addresses. it works together with ProjectHoneyPot and keeps bad IPs out of your webpage before it's even fully loaded...

also, there is a way to hide your login page using .htaccess
lock out everyone attempting to login more than a few times as already pointed out by Jimmy

and besides that you should probably enforce the following practises:

  • don't use admin account (create another account with admin privileges, but with a different username than admin and then remove the default admin account)
  • force using SSL
  • use strong passwords
1
  • Note that the tip at hide your login page link above will still not protect wp-login.php, which can be posted to directly by a bot. Apr 12, 2013 at 14:04
2

create a .htaccess rule for the wp-admin directory and set it to either a set list of IP's or a user/pass combo. You don't want to start hacking wordpress if you can avoid it as the next upgrade will just undo your changes, and setting it at the Apache .htaccess level will be a lot more effective than trying to patch wordpress.

2

What's the issue with just limiting the number of login attempts by IP address? http://wordpress.org/extend/plugins/limit-login-attempts/

4
  • I could be wrong about this, but I think the issue here is that even if they can't log in, what they are doing is still causing the page to reload. Does that make sense?
    – epaps
    Dec 14, 2010 at 21:26
  • It does still reload the page. How much traffic is it getting?
    – Jimmy
    Dec 15, 2010 at 18:28
  • The page is literally getting 50x the amount of traffic of any other page. And we're talking about thousands here.
    – epaps
    Dec 16, 2010 at 4:24
  • I say use a combination of my suggestion and pootzko's suggesstion. I would warn against limiting login to certain IP addresses, however, because it can make emergency changes impossible. Go with bad behavior and limit login attempts.
    – Jimmy
    Dec 16, 2010 at 17:20
2

To update upon epaps above EDIT and Answer to the similar question Is there any way to rename or hide wp-login.php?, I too have found the .htaccess rules generated by the (now long abandoned) stealth-login plugin to be the least complex yet most effective means of preventing direct access to wp-login.php / wp-admin and protecting against various attacks (particularly brute-forcing).

Other "solutions" I have read require php functions, changes to wp-config.php and .htaccess rewrites. Or the installation of yet another (bulky) plugin! Many of these either only block the /wp-admin/ URI (easily subverted by going straight to wp-login.php), or break commenter/customer logins.

The stealth-login plugin's final version was v1.3 and was compatible with WordPress versions 2.3 to 2.7.1. The last Internet Archive snapshot from Oct 15, 2011 can be found here where stealth-login.1.3.zip can be downloaded. A compatible version of WordPress can be downloaded from the Release Archive - https://wordpress.org/download/release-archive/. Do the famous 5 minute install, unzip the stealth-login plugin to /wp-content/plugins and you can now generate a ruleset for your own use.

Mine is as per below and is working perfectly on WordPress 4.7.4 with WooCommerce 3.0.5. The only change I made was adding the rewrite condition on line 12. It was necessary to prevent WooCommerce /my-account/customer-logout from breaking (it was 302 redirecting without the /wp-login.php URI - meaning the query string on its own would not execute the logout, thus nothing happened. Note the string has been left open to pickup the wpnonce variable.

So as noted earlier, this is THE best solution I have found yet - and it can even be made to work with WooCommerce. So simple, yet so effective - thanks epaps for pointing this out.

RewriteRule ^signout wp-login.php?action=logout&_wpnonce=a3d57642ab&stealth_out_key=ow4hzd5lxudcetbgbfreaox6c1 [L]
RewriteRule ^signin wp-login.php?stealth_in_key=05gvov4wuuruahpuchpohavitl&redirect_to=https://yourwebsite.com/wp-admin/ [R,L]
RewriteRule ^admin wp-admin/?stealth_admin_key=f4ji1q6tpwr55s5a0h65clg0qk [R,L]
RewriteCond %{HTTP_REFERER} !^https://yourwebsite.com/wp-admin 
RewriteCond %{HTTP_REFERER} !^https://yourwebsite.com/wp-login\.php 
RewriteCond %{HTTP_REFERER} !^https://yourwebsite.com/signin 
RewriteCond %{HTTP_REFERER} !^https://yourwebsite.com/admin 
RewriteCond %{QUERY_STRING} !^stealth_in_key=05gvov4wuuruahpuchpohavitl 
RewriteCond %{QUERY_STRING} !^stealth_out_key=ow4hzd5lxudcetbgbfreaox6c1 
RewriteCond %{QUERY_STRING} !^stealth_reg_key=rue2bekyask21pwtegavqbbp5n 
RewriteCond %{QUERY_STRING} !^stealth_admin_key=f4ji1q6tpwr55s5a0h65clg0qk 
RewriteCond %{QUERY_STRING} !^action=logout&redirect_to=https%3A%2F%2Fyourwebsite.com%2Fmy-account%2F&_wpnonce= 
RewriteRule ^wp-login\.php https://yourwebsite.com [L] 
RewriteCond %{QUERY_STRING} ^loggedout=true 
RewriteRule ^wp-login\.php https://yourwebsite.com [L] 
1

As a suggestion, if you're on a static IP you could use a .htaccess .passwd file to restrict access to the admin directory to a known list of IP addresses. Whilst this won't prevent the access attempts, it will at least lower the resource usage.

1

As an addition to your security you can try this simple WordPress plugin:

http://themext.com/protected-wp-login/

The website is no longer available but the code is still on GitHub

It protects against brute force your admin's login page (by using a secure key in the url).

1
  • 1
    Thanks, really useful plugin. I use it already for protecting my wp-login page.
    – starikovs
    Apr 18, 2013 at 10:49
0

I've created a plugin that allows you to customize the login URL and also prevents remote form $_POST commands by checking the URL of the request.

It's not perfected with the rest of the WP login URLs that are in the toolbar and lost password link, but it has reduced login attempts to zero for several days during the brute force attacks of 2013 still going on.

http://wordpress.org/extend/plugins/stealth-login-page/

0

Its might me brute force attack

Add the following code to bottom of your functions.php in theme folder it will stop the ping back request.

add_filter( 'xmlrpc_methods', 'remove_xmlrpc_pingback_ping' );
function remove_xmlrpc_pingback_ping( $methods ) {
unset( $methods['pingback.ping'] );

return $methods;
}

and change the wplogin page by using the following plugin

-2

I seem to have found an answer to this.

I`ve been struggling with theese login attempts for a long time and decided to do an experiment.

First of all i don't use admin as my admin user. Therefore they wont get in since all the attacks are based on the "admin" user name.

I set up a user account that i named Admin and set the password to "12345". I forwarded this account to a html page that i call "busted". At first i was suprised that the bots still could`nt get in.

A bot finally got in two weeks ago. I haven't had any attacks since. No attacks at all after that.

It might be luck, but it also might have worked.

1
  • This is NOT working and VERY DANGEROUS. Please remove this advice.
    – Mr. Hugo
    Jul 3, 2016 at 21:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.