Wordpress Brute Force Prevention

Question

I am using WordFence security plugin for keeping track of login attempts and I regularly check the logs from it. I realize that there are going to be a lot of login attempts with the username 'admin'. Most only try a couple times and leave the site alone. However, I am having one particular attempt that is more troubling.

I am receiving multiple login attempts from Italy and each day I check it, the logs are filled with new login attempts from Italy. The brute force attempt is using the wrong username so I am not worried at the moment of them getting in but I would like to limit these automated attacks. Normally I would just block an IP like this but the problem is this seems to be coming from a lot of different IP's all with the location of Italy. I went through them and I didn't find any with the same IP. Most start with 93.x.x.x or 78.x.x.x however thats about as similar as they get.

What would be my best course of action to stop these attacks? I don't want to block the whole 93.x.x.x or 78.x.x.x network because that could potentially be a lot of traffic and I feel as if that is just a "band-aid". Would getting a CAPATCHA for the login help? Anyone else overcome an issue like this?

Answer 1

Rather than blacklist logins, why not whitelist your own IP (example 12.345.67.891 below; or a range) for wp-login.php and in wp-admin for logins and administration? (No plugin needed).

A whitelist will block everyone else except you from login. See http://httpd.apache.org/docs/2.4/howto/access.html

in the .htaccess in the wp-admin folder:

Options All -Indexes

order deny,allow
deny from all
allow from 12.345.67.891
allow from 12.345.89.0/24  //example CIDR range; see http://www.ipaddressguide.com/cidr#range

deny from all

in the .htaccess in web root:

<Files wp-login.php>
order deny,allow
deny from all
allow from 12.345.67.891
allow from 12.345.89.0/24  //example CIDR range
deny from all
</Files>

And then check your logs afterward.