I have a WP install that's been getting hammered the last couple days by brute force login attempts.
The site has the Limit Login Attempts plug-in installed. And when I started getting frequent notifications about lockouts, I decided since I only access the
wp-login.php file and the
wp-admin from one place, to block all IPs but my own via
.htaccess. I've tested the
.htaccess block by removing my IP from the exception list, and it does indeed block access to wp-login.php. So it appears to work from that aspect.
However, even with IPs blocked, Limit Login Attempts keeps reporting (frequent) lockouts from IPs. I thought this was curious, since with the
.htaccess block in place, it seems as though it should be impossible to get to the
wp-login.php script to begin with, let alone get so far as having an attempted login get processed by the plug-in.
So I tried another experiment: While already logged into WP, I changed the name of
wp-login.xyz thus disabling the script from running entirely. Even with the login script completely disabled, I still got notices that login attempts are being made and IPs are being locked out.
Then I thought perhaps someone's got an auth cookie. So I changed the salts. Still the attempts come.
I've looked at the codex for help on the Authentication API, but most of the sources there are incomplete, and in any case I'm not finding how it might be possible to attempt a login other than via
So my question is: What, if any, other means of attempting a login are possible without the
wp-login.php script? And how can any such alternate login routes be disabled?
.htaccess code (first lines of file): This is in the WP root directory (same location as
<FilesMatch wp-login.php> order deny,allow Deny from all # Allow from this IP address allow from xx.xxx.xxx.xx #My IP </FilesMatch> ErrorDocument 401 "Sorry. No logins here!" ErrorDocument 403 "Sorry. No logins here!"