The security settings of a website we have was done according to Wordpress Recommendations and we did not have any single hacking attempts for months. Especially that wp-login.php and wp-admin are only limited by IP Address as follows:
<Files wp-login.php> order deny,allow allow from a.b.c.d deny from all </Files>
Today, we had hacking attempts through Tor network according Wordfence security. Luckily, all the IP addresses were blocked and the website is safe. But how can they login if they don't have access to wp-login.php? I have tested it via url and got a forbidden error:
Forbidden You don't have permission to access /wp-login.php on this server.
What makes it even weirder for me, is that wordfence says that those IP addresses did not access any single page while trying to login. They don't even appear in the "All Hits" section, just in the "Logins and Logouts" section.
Any help is appreciated.