0

I've got a very strange problem. Actually my server is being attacked by a brute force on wp-login.php. But when I look into the access log file I see that it's from 127.0.0.1...

www.*.fr:80 127.0.0.1 - - [29/Apr/2015:18:23:01 +0200] "POST /wp-login.php HTTP/1.0" 200 6254 "-" "-"
www.*.fr:80 127.0.0.1 - - [29/Apr/2015:18:23:01 +0200] "POST /wp-login.php HTTP/1.0" 200 6254 "-" "-"
www.*.fr:80 127.0.0.1 - - [29/Apr/2015:18:23:01 +0200] "POST /wp-login.php HTTP/1.0" 200 6254 "-" "-"
www.*.fr:80 127.0.0.1 - - [29/Apr/2015:18:23:01 +0200] "POST /wp-login.php HTTP/1.0" 200 6254 "-" "-"
www.*.fr:80 127.0.0.1 - - [29/Apr/2015:18:23:01 +0200] "POST /wp-login.php HTTP/1.0" 200 6254 "-" "-"
www.*.fr:80 127.0.0.1 - - [29/Apr/2015:18:23:01 +0200] "POST /wp-login.php HTTP/1.0" 200 6254 "-" "-"
www.*.fr:80 127.0.0.1 - - [29/Apr/2015:18:23:01 +0200] "POST /wp-login.php HTTP/1.0" 200 6254 "-" "-"
www.*.fr:80 127.0.0.1 - - [29/Apr/2015:18:23:02 +0200] "POST /wp-login.php HTTP/1.0" 200 6254 "-" "-"

I don't know what to do to stop that because by default fail2ban doesn't scan 127.0.0.1.

Do you have any idea ?

THanks !

  • This is the regular check for an active session from WordPress itself. Search for heartbeat on our site. – fuxia Apr 29 '15 at 16:31
  • 1
    It may be that your site has a compromised file on the server which posts to the wp-login.php page attempting to get into the Admin Panel. Since your server is hosting the file its given the local IP. Do you have comments enabled on your website? – Howdy_McGee Apr 29 '15 at 17:01
  • Thanks for your reply. Comments are enabled on my website. I use Wordfence to protect and scan all the files but it doesn't detect anything now. When I restart Apache2 the infinite wp-login stops. – axelparatre Apr 30 '15 at 8:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.