Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

My Windows 2003 VPS recently hang due to bots hammering my WordPress login php non-stop for hours (determined from IIS6 logs). This caused MySQL to use up all the allocated 1G RAM. After resetting my VM, I quickly renamed wp-login.php to prevent my server from crashing again.

As per standard practice to rename the administrator username and admin login folders/paths of newly installed web applications, right after I installed my WP in June for the first time, I had tried to rename wp-admin folder, but failed. I added Windows authentication to wp-admin in hope that this will help improve security, however, as it has been proved, this didn't prevent a DDOS like attack on wp-login.php.

For the time being, I'll have to rename it back to the original wp-login.php should I need to login. Is there a way to permanently rename wp-login.php and have it function at the same time? I've installed the Ionics Isapi Rewrite Filter to allow IIS6 to support htaccess to some extent.

So far, the articles I found on the Internet are for Apache and for changing the admin username and password (one website even suggested using a password that is at least 30 characters long!).

EDIT:

I removed anonymous access for wp-login.php also, enabled Windows authentication and then diverted the Custom Error page for "HTTP 401.2 - Unauthorized" error to a blank HTM file. I don't know if this method can fool the botnet but when tested with curl.exe, if the user is unauthenticated, a blank page will appear.

EDIT:

The above method proves to be ineffective. :( The botnet came back and attacked my protected wp-login.php. I've renamed wp-login.php, let's see what happens now.

share|improve this question
1  
There's a discussion going on at [wp-hackers], maybe you'll find useful info. The related column here at the right has this. –  brasofilo Jul 13 '13 at 16:21
    
@brasofilo Yes, I saw that, but please correct me if I'm wrong, but there isn't anyhing that will protect or rename the login. –  Joshua Jul 14 '13 at 7:34

1 Answer 1

I wrote a blog post a while back, this is a quick and dirty hack to make hackers think your wp-login.php is a 404 page. http://dave.kz/hide-your-wp-login-page-from-hackers/.

(From blog post) Basically, I've added...

header("HTTP/1.0 404 File Not Found");

to the top of the wp-login.php page. Hopefully the attacker is looking for a 200 HTTP response.

In addition you could do something like...

if(!isset($_GET['allow']) || $_GET['allow']!='true'){
    echo "Sorry, you need to use the magic URL to login.";
    die();
}

again, at the top of wp-login.php. This method would require you to go to http://www.example.com/wp-login.php?allow=true

share|improve this answer
    
Thank you for the link, are we able to find out if this method works? –  Joshua Jul 14 '13 at 7:42
    
David, please don't post links only. If the link disappears it makes the question useless and it's hard to maintain working links on that many pages. Please rework your answer. –  kaiser Jul 14 '13 at 16:58
    
@Joshua, it's impossible to tell if this is going to work. It depends how smart the attackers are. If their script looks at the HTTP request code, this should be pretty effective. –  David Kryzaniak Jul 15 '13 at 15:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.