.htaccess password protection bypassed

Question

I’ve created .htaccess password in order to add a layer of security to a WordPress installation. The .htpasswd file is located one level above the installation.

Yet, I’ve seen brute force attack attempts that seem to bypass this login and directly try to login in WordPress wpadmin, using the correct username (which is not “admin” but a random string of character).

I know that the .htaccess solution is not perfect. I was wondering if there was a way to make it more secure? I wonder how the attack is able to bypass the .htaccess protection, but that may be too broad a question.

Any suggestion will be welcomed.

Thanks,

P.

P.S. I run my installation on a server that uses apache. My .htaccess file looks like this:

<Files wp-login.php> AuthUserFile /home/servername/.htpasswd AuthType Basic AuthName Restricted Order Deny,Allow Deny from all Require valid-user Satisfy any </Files>

Answer 1

What web server you use? If use nginx, you can try this to secure your wp-admin :

location ~ ^/(wp-login\.php$) {
 root /var/www/wordpress/;
     allow 127.0.0.1;
     allow Your-ip-address;
     allow Your-second-ip-address;
     deny all;

Other way to secure your wp-admin from brute force attacks is to add this lines to your nginx.conf :

Limit Request

limit_req_status 403;
limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;

And those lines to your nginx virtual host conf:

# Limit access to avoid brute force attack
location = /wp-login.php {
        limit_req zone=one burst=1 nodelay;
        include fastcgi_params;
        fastcgi_pass php;
}

With this setup, the hackers will got 403 forbidden when try to bruteforce.

In your situation, I think the .htaccess setup may be wrong. If you don't have access to your web server and you use apache, your .htaccess file must be in your wordpress document root.

Answer 2

First, contrary to Mark Kaplun's answer htaccess protecting wp-login is recommended in the Wordpress Codex and far from pointless. It will block many brute force/DDOS attacks BEFORE WP scripts are run and DB Connections and lookups are done i.e. drastically reduces server load; it enabled one of my sites to continue to be responsive instead of slow or falling over. Additionally many brute force tools are likely to halt immediately if presented with an authentication digest request.

As you are required to enter credentials your htaccess is working. But you need to do more.

Protect your admin directory via its own htaccess file. The Codex above suggests (see caveats) "blocking" by IP. This may not be practical if you travel, so I password protect the directory instead, and this works fine.

"(hackers) using the correct username (which is not “admin” but a random string of character)"

Prevent hackers identifying your (case insensitive) login names:

WP uses your username to create an author URL slug i.e. broadcasting it to the world (even in Google searches). Advice in articles to change your admin user name (without additional warnings) give those taking the advice a false sense of security and demonstrate the article authors lack of knowledge (I haven't seen one hacker article saying try to login with "admin" - but I've seen many suggesting finding author slugs.).

Try browsing yoursite.com/?author=1 (or author=2 or author=3) chances are the resulting URL or content will identify your (case insensitive) login name. N.B. if you changed the initial admin you may have deleted author "1").

Typically Hackers use security tools to list the first ten users (low numbers are more likely to be an admin). Use htaccess to foil most such tools and either 403 or redirect their requests e.g.

RewriteCond %{QUERY_STRING} author=
RewriteRule (.*) https://www.fbi.gov/investigate/cyber/%1 [R=302,L]

However; on most sites it will still be possible to manually identify username from author link URLs which themes normally include in posts. Yours is already known. The solution is to create a new admin user and immediately change its URL slug (user_nicename) entry in the WP database. You do this using a plugin (possibly) https://wordpress.org/plugins/edit-author-slug/ (which you can then remove). Or if confident by using phpMyadmin. If you can login using you new admin user then you can delete your old admin.

You can see the above suggestions in action on my site (click on any author (AW) link to see change to nicename/url slug; and add "?author=1" to the original link to see redirection).

Answer 3

The only viable protection is to use strong passwords (actually with my experience even medium strength passwords will be enough to keep away any random script kiddy).

The wp-login.php file is mainly UI and it is just one possible attack vector, with others will be the xml-rpc, rest api, and whatever plugins that let you do login via ajax.

using htpasswd file, with passwords that is not stronger than the password that you use in wordpress is kinda pointless, and if your password there is stronger than the one in wordpress, why is it?

To your other point.... wordpress do not do any real effort in hiding user names. Not always it is easy to get them, but there is no attempt to hide them. Therefor the fact that someone tried to login with the correct user name, it is just a fact of life when using wordpress and by itself it do not indicate any malicious attempt more complex than the "normal" script kiddies hacking attempts.