Are there ways of logging in that bypass wp-login.php altogether?

Question

I have a WP install that's been getting hammered the last couple days by brute force login attempts.

The site has the Limit Login Attempts plug-in installed. And when I started getting frequent notifications about lockouts, I decided since I only access the wp-login.php file and the wp-admin from one place, to block all IPs but my own via .htaccess. I've tested the .htaccess block by removing my IP from the exception list, and it does indeed block access to wp-login.php. So it appears to work from that aspect.

However, even with IPs blocked, Limit Login Attempts keeps reporting (frequent) lockouts from IPs. I thought this was curious, since with the .htaccess block in place, it seems as though it should be impossible to get to the wp-login.php script to begin with, let alone get so far as having an attempted login get processed by the plug-in.

So I tried another experiment: While already logged into WP, I changed the name of wp-login.php to wp-login.xyz thus disabling the script from running entirely. Even with the login script completely disabled, I still got notices that login attempts are being made and IPs are being locked out.

Then I thought perhaps someone's got an auth cookie. So I changed the salts. Still the attempts come.

I've looked at the codex for help on the Authentication API, but most of the sources there are incomplete, and in any case I'm not finding how it might be possible to attempt a login other than via wp-login.php.

So my question is: What, if any, other means of attempting a login are possible without the wp-login.php script? And how can any such alternate login routes be disabled?

EDIT: .htaccess code (first lines of file): This is in the WP root directory (same location as wp-login.php.

<FilesMatch wp-login.php>
order deny,allow
Deny from all

# Allow from this IP address
allow from xx.xxx.xxx.xx  #My IP
</FilesMatch>

ErrorDocument 401 "Sorry. No logins here!"
ErrorDocument 403 "Sorry. No logins here!"

Answer 1

The answer is most likely XML-RPC which is used to communicate with the mobile wordpress apps and is always on in newer versions. If you don't use mobile apps to admin your WP you can use my plugin - http://wordpress.org/plugins/control-xml-rpc-publishing/ to disable it.

Answer 2

As @MarkKaplun suggested, the problem was indeed XML-RPC. I contacted the hosting company and asked for a readout of the logs. xmlrpc.php had been hit over 3500 times in less than 24 hours (and this is a small site where nobody would have any reason to hit anything that many times!).

Edit

Here's what I suspect was happening. From Antti Vilpponen's blog on mitigating xmlrpc attacks:

From the tests I’ve carried out, I’ve seen that WordPress is also supporting URLs with credentials. So, an attacker can use a URL like http://admin:[email protected]/changeDNS.asp?newDNS=aaaa to reconfigure the internal router.

So it's hitting xmlrpc.php with the credentialed request that has the same effect as using wp-login.php and triggers WP to go into its authentication routine -- which in turn was triggering the Limit Login Attempts plugin and generating the lockouts.

/Edit

Rather than use a plug-in (this was before @MarkKaplan answered), I opted to simply cut off all access to xmlrpc.php at the server, again using .htaccess in the WP root as follows:

<Files xmlrpc.php>
    Order allow,deny
    Deny from all
</Files>

Worked like a charm. My login has been silent.

Edit

The filename in the Apache directive was misspelled as xlmrpc.php. Tried to correct it but stackexchange character edit limit didn't let me until I wrote this useless paragraph. It is now correct.