Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I'm seeing this quite often:

enter image description here

No OS, same Browser, weird hostname -- they're definitely not real users. Can I do anything to take precautions before they do something?

Thanks!

share|improve this question
    
You can restrict access to dashboard by IP. Basically, adding a captcha to login forms also helps against bruteforce attacks (by slowing them down to a crawl). –  its_me Jun 24 '12 at 4:30
add comment

2 Answers

up vote 4 down vote accepted

There's an app plugin for that, Limit Login Attempts.

Some more info available in this wp beginner post: http://www.wpbeginner.com/plugins/how-and-why-you-should-limit-login-attempts-in-your-wordpress/

share|improve this answer
add comment

Since it looks as there is no referrer you could block the attempts with .htaccess. Something like this:

RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /.*/wp-login\.php.*\ HTTP/ [NC]
RewriteCond %{HTTP_REFERER} ^-?$
RewriteRule .* - [F,NS]

There are different variations on that, you could even just trying using REQUEST_URI instead.

RewriteCond %{REQUEST_URI} wp-login\.php [NC]
RewriteCond %{HTTP_REFERER} ^-?$
RewriteRule .* - [F,NS]

Or if you're the only person logging into your site you could lock it down even more like so:

RewriteCond %{REQUEST_URI} wp-login\.php [NC]
RewriteCond %{REMOTE_ADDR} !^xxx\.xxx\.xxx\.xxx$
RewriteRule .* http://example.com [R=301,L]

Where xxx.xxx.xxx.xxx is your static IP Address. Can be modified to just work for Class A, B, or C if you have a dynamic IP Address.

Where example.com is your TLD. That way they're just redirected to your home page.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.