0

My Windows 2003 VPS recently hang due to bots hammering my WordPress login php non-stop for hours (determined from IIS6 logs). This caused MySQL to use up all the allocated 1G RAM. After resetting my VM, I quickly renamed wp-login.php to prevent my server from crashing again.

As per standard practice to rename the administrator username and admin login folders/paths of newly installed web applications, right after I installed my WP in June for the first time, I had tried to rename wp-admin folder, but failed. I added Windows authentication to wp-admin in hope that this will help improve security, however, as it has been proved, this didn't prevent a DDOS like attack on wp-login.php.

For the time being, I'll have to rename it back to the original wp-login.php should I need to login. Is there a way to permanently rename wp-login.php and have it function at the same time? I've installed the Ionics Isapi Rewrite Filter to allow IIS6 to support htaccess to some extent.

So far, the articles I found on the Internet are for Apache and for changing the admin username and password (one website even suggested using a password that is at least 30 characters long!).

EDIT:

I removed anonymous access for wp-login.php also, enabled Windows authentication and then diverted the Custom Error page for "HTTP 401.2 - Unauthorized" error to a blank HTM file. I don't know if this method can fool the botnet but when tested with curl.exe, if the user is unauthenticated, a blank page will appear.

EDIT:

The above method proves to be ineffective. :( The botnet came back and attacked my protected wp-login.php. I've renamed wp-login.php, let's see what happens now.

Improve this question
2
  • 1
    There's a discussion going on at [wp-hackers], maybe you'll find useful info. The related column here at the right has this.
    – brasofilo
    Commented Jul 13, 2013 at 16:21
  • @brasofilo Yes, I saw that, but please correct me if I'm wrong, but there isn't anyhing that will protect or rename the login.
    – Joshua
    Commented Jul 14, 2013 at 7:34

1 Answer 1

Reset to default
-1

I wrote a blog post a while back, this is a quick and dirty hack to make hackers think your wp-login.php is a 404 page. http://dave.kz/hide-your-wp-login-page-from-hackers/.

(From blog post) Basically, I've added...

header("HTTP/1.0 404 File Not Found");

to the top of the wp-login.php page. Hopefully the attacker is looking for a 200 HTTP response.

In addition you could do something like...

if(!isset($_GET['allow']) || $_GET['allow']!='true'){
    echo "Sorry, you need to use the magic URL to login.";
    die();
}

again, at the top of wp-login.php. This method would require you to go to http://www.example.com/wp-login.php?allow=true

Improve this answer
3
  • Thank you for the link, are we able to find out if this method works?
    – Joshua
    Commented Jul 14, 2013 at 7:42
  • David, please don't post links only. If the link disappears it makes the question useless and it's hard to maintain working links on that many pages. Please rework your answer.
    – kaiser
    Commented Jul 14, 2013 at 16:58
  • @Joshua, it's impossible to tell if this is going to work. It depends how smart the attackers are. If their script looks at the HTTP request code, this should be pretty effective.
    – David Kryzaniak
    Commented Jul 15, 2013 at 15:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.