Make wordpress admin failed login attempt return 401

Question

Currently, wordpress default is returning 200 on either failed or successfull login attempt. The modern standard, used by all web application framework is to return 401 (or 403) on failed login attempts.

This allows third party tools (think waf, fail2ban, etc) to detect brute forcing attempt and block it from outside of wordpress.

I can't find where I can make this change or is there a plugin providing such a functionality.

Yes, I'm well aware of plugins who attempt to provide "brute force blocking" from inside of Wordpress. But besides being a problem on their own, they are prone to being shut from inside the Wordpress installation. And the defence is placed in the wrong level. Instead of being a perimeter defense, all those requests hit the actual wordpress Installation. So no, this isn't a good option for me.

Thanks for the help!

Answer 1

WordPress handles login failed in two ways:

1. If it is a bad credential, and both username and password have a value, then this action can be captured by wp_login_failed

2. If both, or one, of the options are empty, then WordPress generates the error object as the first parameter in the authenticate filter; it does not open and wp_login_failed action captures this cause/event For what we have done here,

see comments in code:

add_filter( 'authenticate', function( $user, $username, $password ) {
    // forcefully capture login failed to forcefully open wp_login_failed action, 
    // so that this event can be captured
    if ( empty( $username ) || empty( $password ) ) {
        do_action( 'wp_login_failed', $user );
    }
    return $user;
} );

// to handle even you can handle the error like
add_action( 'wp_login_failed', function( $username ) {
    if ( is_wp_error( $username ) ) {
        // you return 401 with wp function, this action takes place before header sent.
        $wp_query->set_401();
        status_header( 401 );
        nocache_headers();

    }
} );

my answer is a combination of : Redirect user using the 'wp_login_failed' action hook if the error is 'empty_username' or 'empty_password' and How to force a 404 on WordPress

update: I wrote super simple plugin to do this WP-401-On-Failed-Login. It uses some wp auth hooks, and set_header() before content being sent.

Answer 2

If you have access to the server your site is running on, you could use modsecurity to return 401 from the web server (instead of through PHP).

Here's a tutorial I wrote a while back about blocking IPs and returning 401 through modsecurity:

https://smyl.es/how-to-block-wp-login-php-brute-logins-with-cpanel-mod-security-and-configserver-firewall/

Answer 3

WordPress core (and others) disagree 401 (and 403) are the correct "modern standard" and that "all web application frameworks" use 401 (or 403) for failed logins.

See WordPress core Trac ticket #25446 to understand why failed logins return HTTP 200, and why this has not been changed to 401 (or 403).

You can solve the original problem by adjusting fail2ban and similar tools to filter HTTP POST requests to wp-login that result in HTTP STATUS CODE 200. Successfully posted logins get a 301 redirect.