The security settings of a website we have was done according to Wordpress Recommendations and we did not have any single hacking attempts for months. Especially that wp-login.php and wp-admin are only limited by IP Address as follows:

<Files wp-login.php>
order deny,allow
allow from a.b.c.d 
deny from all

Today, we had hacking attempts through Tor network according Wordfence security. Luckily, all the IP addresses were blocked and the website is safe. But how can they login if they don't have access to wp-login.php? I have tested it via url and got a forbidden error:


You don't have permission to access /wp-login.php on this server.

What makes it even weirder for me, is that wordfence says that those IP addresses did not access any single page while trying to login. They don't even appear in the "All Hits" section, just in the "Logins and Logouts" section.

Any help is appreciated.

2 Answers 2


WordPress is also an XML-RPC server. So I guess these bots tried to gain access through the XML-RPC protocol via the xmlrpc.php file in your WordPress root directory.

It's possible to login and most likely your security plugin is picking up failed login attempts when wp_authenticate() is called and the wp_login_failed hook is activated.

Here's the relevant part:

 * Filter whether XML-RPC is enabled.
 * This is the proper filter for turning off XML-RPC.
 * @since 3.5.0
 * @param bool $enabled Whether XML-RPC is enabled. Default true.
 $enabled = apply_filters( 'xmlrpc_enabled', $enabled );

 if ( ! $enabled ) {
     $this->error = new IXR_Error( 
         sprintf( __( 'XML-RPC services are disabled on this site.' ) ) 
     return false;

  $user = wp_authenticate($username, $password);

so you can see that using:

add_filter( 'xmlrpc_enabled', '__return_false' );

will throw an IXR_Error error instead of trying to authenticate the user.

Some choose to block access to the xmlrpc.php file.

  • You are right. I blocked access to it and all attacks have stopped. Thanks a lot
    – Sami
    Oct 3, 2015 at 23:11

In addition to the obvious login via XML-RPC, it is just not smart to think that there are admin,login and front-end url with a clear cut separation between them. If you use one of the ajaxified login plugin then login attempts can come from anywhere without passing via the login.php file. The only real way to protect against brute force attacks is to have a strong password.

Security plugins will obviously notify you on any perceived security event to make you think they are doing something worthy, but like with fighting spam, you should not be worried about being attacked but about having a good defense. Once and attacker passed your defense even one time, the game is probably over and it is too late to react.

As for blocking IP ranges - it can be useful if all the computers in the range are under your control, otherwise it is not very effective. Lets say you have limit the IP to the US, do you know how many open proxies, tor node, hacked servers and hacked desktops are there in the US? and some of them at some point will be used against you. If your password is 123456 you will be easily hacked even with IP limiting. And then of course someone can get your authoritative cookies when you admin over a public WiFi and doesn't even need to go to wp-login.php to "login".

  • I agree. We have followed all tips suggested by Wordpress to increase the security of the website. We have strong passwords and hard to guess usernames that are only accessible via VPN. Brute force would not have a chance to gain access but I was still surprised that they managed to try to login after all of that (About 400 attempts in 10 minutes from various IP addresses). The XML-RPC one is what I missed.
    – Sami
    Oct 3, 2015 at 23:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.