0

My website is getting somewhat popular, and with the it's increasing popularity there's an increase in the hackers.

Last night I visited my security logs and found that everyday approximately 10 people try to access

 /?author=1
 /?author=2
 /?author=3
 /?author=4

but I don't have any of these user IDs, so a 404 is generated to them. they also run a guessing bots on usernames:

 admin
 administrator
 wordpress

Now, I want to troll them... so each time they try to access any of these two:

 1. visiting /?author=1..etc
 2. trying to login with admin username

I want their IP blocked off my site, and redirected to a youtube video.

I know the first one can be done with .htaccess trick, but can't quietly get this trick. the second one I guess is done by php, but I have no experience with Wordpress although I'm pretty good with PHP.

  • 1) Blocking the hack attempts, I understand. 2) Passing the problem to someone else? Very unfriendly and possibly qualifies as hacking on your part. – s_ha_dum Apr 10 '14 at 13:43
  • See Can I Prevent Enumeration of Usernames? – fuxia Apr 10 '14 at 14:30
  • There are plenty of existing solutions around that deal with limiting login attempts. Please note that plugin recommendations are considered not in scope here and provide some info on what you had already reserched, tried and which more specific challenges you are facing. – Rarst Apr 10 '14 at 18:58
0

I understand this isn't exactly what you're looking for but these hackers are most likely bots and redirecting them won't matter at all. I suppose you could modify the below code if you reallllly wanted to but this will redirect anybody looking for an author back to your homepage.

RewriteCond %{REQUEST_URI}  ^/$
RewriteCond %{QUERY_STRING} ^/?author=([0-9]*) [NC]
RewriteRule ^(.*)$ http://%{HTTP_HOST}/? [L,R=301,NC]
2

The solution to restrict access to author's archives with .htaccess rule does pretty decent job. However, not everyone can edit or have access to .htaccess, especially on shared hosting accounts. The code below require PHP version 5.3+.

Here is the solution which deals with the problem on WordPress level. Put this code in your theme's function.php file:

<?php    
if ( ! is_admin() ) {
    add_filter(
        'query_vars',
        function ( $public_query_vars ) {    
            foreach ( array( 'author_name', 'author' ) as $value ) {
                $key = array_search( $value , $public_query_vars );
                if ( false !== $key ) {
                    unset( $public_query_vars[$key] );
                }
            }    
            return $public_query_vars;
        }
    );
}
?>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.