Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I Installed the plugin Simple Login Lockdown and since a couple of days ago the database is recording over 200 records by day.

I think that is not possible to have my site attacked by so many IP's

Do you think there is something wrong?

share|improve this question
4  
Sure its possible. You know those people who click on everything without really paying attention to what they are clicking on? Blame them. –  s_ha_dum Apr 12 '13 at 14:03
    
Do you guys know how to whitelist myself? I have overtested this plugin to the situation where I get the following: "Access denied. Your IP address [My IP] is blacklisted. If you feel this is in error please contact your hosting providers abuse department." The readme tells something but I don't know how to correctly apply modifications and where. Which file to edit? –  Boris_yo Apr 18 '13 at 10:29

2 Answers 2

There is currently a botnet active, attacking WordPress and Joomla sites. And probably more. You should see more blocked logins. If you don’t, there is probably something wrong.

But be aware, blocking IP addresses doesn’t help against a bot net with more than 90,000 IP addresses.
And if you do that per plugin avoid Limit Login Attempts. It stores the IPs in a serialized option that has to be unserialized on each request. This is very expensive and slow.
Find a plugin that uses a separate database table or block the IP addresses in your .htaccess like this:

order allow,deny
# top 30 IP addresses listed in 
# http://blog.sucuri.net/2013/04/mass-wordpress-brute-force-attacks-myth-or-reality.html
deny from 31.184.238.38
deny from 178.151.216.53
deny from 91.224.160.143
deny from 195.128.126.6
deny from 85.114.133.118
deny from 177.125.184.8
deny from 89.233.216.203
deny from 89.233.216.209
deny from 109.230.246.37
deny from 188.175.122.21
deny from 46.119.127.1
deny from 176.57.216.198
deny from 173.38.155.22
deny from 67.229.59.202
deny from 94.242.237.101
deny from 209.73.151.64
deny from 212.175.14.114
deny from 78.154.105.23
deny from 50.116.27.19
deny from 195.128.126.114
deny from 78.153.216.56
deny from 31.202.217.135
deny from 204.93.60.182
deny from 173.38.155.8
deny from 204.93.60.75
deny from 50.117.59.3
deny from 209.73.151.229
deny from 216.172.147.251
deny from 204.93.60.57
deny from 94.199.51.7
deny from 204.93.60.185

allow from all

See also:

Our tag is also worth a look, especially:

If you have moved wp-admin or your wp-login.php these URLs can still be guessed by appending /login or /admin to the main URL. WordPress will redirect these requests to the correct location.
To stop that behavior you can use a very simple plugin:

<?php  # -*- coding: utf-8 -*-
/* Plugin Name: No admin short URLs */

remove_action( 'template_redirect', 'wp_redirect_admin_locations', 1000 );

I think this is security by obscurity – nothing serious.

share|improve this answer
    
I have numerous sites that get thousands on some days, it's entirely automated –  Tom J Nowell Apr 12 '13 at 13:46
    
We've seen a marked uptick in lockouts on our WordPress sites as well, join the club @Minapoli. –  Andrew Bartel Apr 12 '13 at 18:23
    
I use and love Limit Login Attempts, but in this case, it won't entirely help, because the botnet appears to be savvy enough only to try a handful of attempts with any given IP address. So, it effectively bypasses the per-IP lockout engaged by repeat login failures. –  Chip Bennett Apr 12 '13 at 18:24
    
@Chip Bennett it seems to be only trying 'aaa', 'administrator' and 'admin' on our sites, are you seeing it any other usersnames being targeted? –  Andrew Bartel Apr 12 '13 at 18:33
2  
@RRikesh Not sure. Usually siteurl/login redirects to the correct login page. –  toscho Apr 13 '13 at 14:50

In addition to the resources toscho listed in his answer, you could also use PHP's Basic HTTP Authentication to password protect wp-admin and or wp-login.php to block access to wp-login.php.

I just released a plugin that does this for you along with blocking No-Referrer requests. (The No-Refrrer block currently does not work for sites installed in a subdirectory).

share|improve this answer
    
Note that will lock out users with PHP running per (Fast-)CGI. –  toscho Apr 15 '13 at 10:30
    
Thanks for that! It works on PHP-FPM but after searching I see it won't work when php is running CGI/SuExec I'm going to have to make a quick update to deactivate the plugin in that environment. –  Chris_O Apr 15 '13 at 20:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.