0

I have put up a logging script on my wp-login page. I noticed that a particular ip address- 193.176.147.7 has been consistently visiting my login page for some days now. The vitis are always in quick succession and 3 times exacly. That is the no. Of failed attempts my plugin allows, before suspending an ip. Should I be concerned and is there any precaution that I can take? For example blocking that particular IP will help or should I block some range of IPs? I did a whatismyip.com lookup, but they had no information. Does changing the name of my wp-login.php to something else helps?

Improve this question

2 Answers 2

Reset to default
2

No, the requests will still happen, even if it results in a 404. If you keep logging, you'll also notice attempts to log in to Drupal, Joomla, and other major CMS, including server exploits for IIS Apache and Nginx

This is because they're automated opportunistic requests, they're not actually looking at your site, they're only looking for successful logins. Most sites get these, sometimes in large spikes, sometimes as consistent background noise.

If you're worried about your security though, I'd suggest that you:

  • Add a brute force login mechanism, such as the one included in Jetpack, or the popular limit logins plugin
  • Force a minimum password strength, there are several plugins that can do this for you, though I cant recommend one
  • Use 2 factor authentication

Other than that, there isn't anything you can do to eliminate the possibility short of a major breakthrough in computer security research. Moving your login page will either break things, or it'll only work for those bots that are particularly stupid.

Anyone can visit the login page of a site via rewrite rules by going to /login if pretty permalinks are turned on, they can use XMLRPC, and they can visit the admin area at wp-admin and be redirected to the login page. If you move the admin area, aside from breaking things, the user can still visit /admin and be redirected anyway. Moving things sounds like the answer, but it really isn't, it'll just give you a sense of false security, which is far more dangerous.

Improve this answer
1
  • 1
    As an added layer of security for the paranoid you can password protect wp-admin/ directory (being sure to exclude the admin-ajax.php used by some front-facing plug-ins.). While this won't protect wp-login.php (though you could do that too). This adds a layer which is completely independent of WordPress.
    – Stephen Harris
    Apr 11, 2015 at 20:57
0

A Google search for the IP showed, this IP is known as a spammer IP. A quick check on MXtoolbox shows, it is blacklisted by blocklist.de, CBL and Spamhouse ZEN. I would suggest to ban the IP.

Some interesting suggestions, how to prevent wp-login.php from a brute force attack can be found on MNX Solutions.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.