I'm using a security plugin that keep sending me emails:

"A lockdown event has occurred due to too many failed login attempts or invalid username: Username: Admin IP Address:

IP Range: 195.154.243.*

Log into your site's WordPress administration panel to see the duration of the lockout or to unlock the user."

I tried to block the access to wp-admin folder and create htaccess file with this code:

order deny,allow
deny from all
allow from <my ip>

also in the root htaccess i added :

<Files ~ "(wp-login.php|wp-signup.php)">
      Order Deny,Allow
      Deny from all
      Allow from <my ip>

how does the attacker/bot try to login?

  • 1
    Most likely via xmlrpc.php – birgire Dec 23 '15 at 23:38
  • 1
    @birgire thanks ill try to add add_filter('xmlrpc_enabled', '__return_false'); to wp-config.php and c how it goes – DrMosko Dec 24 '15 at 0:55

@birgire has a right answer

And they can use WPScan for example, with a brute force attack on wp-login.php

I recommand to rename your login page, you can do it manually or with a plugin.

  • but how they can get to login after i limited the access to my ip only? – DrMosko Dec 24 '15 at 2:28
  • yes sorry I didn't see very weel your htaccess. Indeed, they can't try anything with your htaccess. – magregre Dec 24 '15 at 8:27
  • they do c @birgire suggestion and that was the problem – DrMosko Dec 30 '15 at 6:13

as @birgire suggest I added

add_filter('xmlrpc_enabled', '__return_false');

to wp-config.php

and no attacker/bot tries to login anymore

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.