My Windows 2003 VPS recently hang due to bots hammering my WordPress login php non-stop for hours (determined from IIS6 logs). This caused MySQL to use up all the allocated 1G RAM. After resetting my VM, I quickly renamed wp-login.php to prevent my server from crashing again.

As per standard practice to rename the administrator username and admin login folders/paths of newly installed web applications, right after I installed my WP in June for the first time, I had tried to rename wp-admin folder, but failed. I added Windows authentication to wp-admin in hope that this will help improve security, however, as it has been proved, this didn't prevent a DDOS like attack on wp-login.php.

For the time being, I'll have to rename it back to the original wp-login.php should I need to login. Is there a way to permanently rename wp-login.php and have it function at the same time? I've installed the Ionics Isapi Rewrite Filter to allow IIS6 to support htaccess to some extent.

So far, the articles I found on the Internet are for Apache and for changing the admin username and password (one website even suggested using a password that is at least 30 characters long!).

EDIT:

I removed anonymous access for wp-login.php also, enabled Windows authentication and then diverted the Custom Error page for "HTTP 401.2 - Unauthorized" error to a blank HTM file. I don't know if this method can fool the botnet but when tested with curl.exe, if the user is unauthenticated, a blank page will appear.

My Windows 2003 VPS recently hang due to bots hammering my WordPress login php non-stop for hours (determined from IIS6 logs). This caused MySQL to use up all the allocated 1G RAM. After resetting my VM, I quickly renamed wp-login.php to prevent my server from crashing again.

As per standard practice to rename the administrator username and admin login folders/paths of newly installed web applications, right after I installed my WP in June for the first time, I had tried to rename wp-admin folder, but failed. I added Windows authentication to wp-admin in hope that this will help improve security, however, as it has been proved, this didn't prevent a DDOS like attack on wp-login.php.

For the time being, I'll have to rename it back to the original wp-login.php should I need to login. Is there a way to permanently rename wp-login.php and have it function at the same time? I've installed the Ionics Isapi Rewrite Filter to allow IIS6 to support htaccess to some extent.

So far, the articles I found on the Internet are for Apache and for changing the admin username and password (one website even suggested using a password that is at least 30 characters long!).

EDIT:

I removed anonymous access for wp-login.php also, enabled Windows authentication and then diverted the Custom Error page for "HTTP 401.2 - Unauthorized" error to a blank HTM file. I don't know if this method can fool the botnet but when tested with curl.exe, if the user is unauthenticated, a blank page will appear.

EDIT:

The above method proves to be ineffective. :( The botnet came back and attacked my protected wp-login.php. I've renamed wp-login.php, let's see what happens now.

My Windows 2003 VPS recently hang due to bots hammering my WordPress login php non-stop for hours (determined from IIS6 logs). This caused MySQL to use up all the allocated 1G RAM. After resetting my VM, I quickly renamed wp-login.php to prevent my server from crashing again.

As per standard practice to rename the administrator username and admin login folders/paths of newly installed web applications, right after I installed my WP in June for the first time, I had tried to rename wp-admin folder, but failed. I added Windows authentication to wp-admin in hope that this will help improve security, however, as it has been proved, this didn't prevent a DDOS like attack on wp-login.php.

For the time being, I'll have to rename it back to the original wp-login.php should I need to login. Is there a way to permanently rename wp-login.php and have it function at the same time? I've installed the Ionics Isapi Rewrite Filter to allow IIS6 to support htaccess to some extent.

So far, the articles I found on the Internet are for Apache and for changing the admin username and password (one website even suggested using a password that is at least 30 characters long!).

My Windows 2003 VPS recently hang due to bots hammering my WordPress login php non-stop for hours (determined from IIS6 logs). This caused MySQL to use up all the allocated 1G RAM. After resetting my VM, I quickly renamed wp-login.php to prevent my server from crashing again.

As per standard practice to rename the administrator username and admin login folders/paths of newly installed web applications, right after I installed my WP in June for the first time, I had tried to rename wp-admin folder, but failed. I added Windows authentication to wp-admin in hope that this will help improve security, however, as it has been proved, this didn't prevent a DDOS like attack on wp-login.php.

For the time being, I'll have to rename it back to the original wp-login.php should I need to login. Is there a way to permanently rename wp-login.php and have it function at the same time? I've installed the Ionics Isapi Rewrite Filter to allow IIS6 to support htaccess to some extent.

So far, the articles I found on the Internet are for Apache and for changing the admin username and password (one website even suggested using a password that is at least 30 characters long!).

EDIT:

I removed anonymous access for wp-login.php also, enabled Windows authentication and then diverted the Custom Error page for "HTTP 401.2 - Unauthorized" error to a blank HTM file. I don't know if this method can fool the botnet but when tested with curl.exe, if the user is unauthenticated, a blank page will appear.