I have a self-hosted WordPress blog, and for weeks someone has been trying log in as admin. I'm looking for a way to stop it. Since I started blocking the originating IP address, the attempts started coming from many IPs but in batches of three or four tries at 10 minute intervals - so it's obviously one person and I guess they're using a botnet.

I use several security steps and keep all plugins up to date. Wordpress is itself automatically kept up to date nowadays, of course.

These are not all my security actions, but I have ... - "Limit Login Attempts" plugin, but the switching around of the IP address by the hacker meant that this didn't have much effect.

  • I password-protect the wp-admin directory with htaccess and htpasswd. Since this had been in place for a long time, I just changed that directory access user name and password, but that made no difference, he still gets to the login dialog.

  • Of course, my WP admin account is not called 'admin' and I deleted the original admin a/c.

  • For a while, I even tried renaming wp-login.php, and moved wp-admin out of the blog's directory. It's quick and easy for me to reverse this when I want to blog or make changes. But Limit Login Attempts still reported attempts - 21 since I renamed/moved these. How is that possible? I've now returned these to the normal place.

  • I added this to .htaccess in the blog's main directory (where nnn etc is my fixed IP and example.com substitutes for the real domain):

    RewriteCond %{REMOTE_ADDR} !^nnn\.nnn\.nnn\.nnn$
    RewriteRule ^wp-(login|register)\.php http://www.example.com/blog/ [R,L]
  • and I added a variation of that to .htaccess in the blog's wp-admin directory:

    RewriteCond %{REMOTE_ADDR} !^nnn\.nnn\.nnn\.nnn$
    RewriteRule ^wp-admin.*?$ http://www.example.com/blog/ [R,L]

When I try to log in from a different IP address via wp-login.php, the first htaccess correctly shunts me straight to the blog's front page. Equally, when I try to access wp-admin from that different IP address, the second htaccess takes me straight to the blog's front page as it should. Only when I try to log in from my fixed IP do I see the request for the directory access passwd, and then the WP login page.

And yet the hacker is able to reach the login dialog. He's not managed to actually log in yet, I run WordPress File Monitor and see no unexpected file changes, and he hasn't discovered the real admin username - but I can't be complacent.

So, can anyone help me understand :

  1. How is it that the hacker can still reach the login page? Even when wp-login.php and wp-admin were temporarily renamed / moved? I cleared the cache and turned supercache off days ago (and renamed wp-super-cache) in case pages in cache were allowing them to reach it.

  2. What can I do to stop this? I have full access to the parent site (shared hosting) and MySQL database.

  • 2
    simple solution 1. use strong password 2. forget about it – Mark Kaplun Feb 19 '16 at 5:00
  • Well if somebody is dedicated to access your website you cannot stop him/her. You can opt-in for a service such as Sucuri (not the free one) and hope that he/she will have hard time and also migrate from the Shared hosting to some VPS or Dedicated. That's all unfortunately. – denis.stoyanov Feb 19 '16 at 6:39

One thing you can do is if you don't have membership website then make it such that wp-admin/wp-login can be open through your IP address and block all other IP address. But make sure that you don't have membership website (No other subscribers/publishers that can login. Only you are the person to log in.)

The other thing you can do is use "CDN" like cloudflare which will filter the IPs before reaching to your server. This make your site fast as well.

Hope this helps.

  • we should mention here that blocking the access to wp-login.php will not block possible xml-rpc access attempts. – birgire Feb 19 '16 at 9:19
  • Yes, as I mentioned, I have d – Roy Grubb Feb 20 '16 at 11:01
  • Yes, as I mentioned in the post, I already made htaccess allow login/register access to my fixed IP only, that hasn't stopped them. I don't have membership on the site. Since then, I moved wp-login.php and the whole of the wp-admin directory to the private area (access via ftp only, i.e. /home/private which is above /home/www/www) of my site. Even that hasn't stopped it. Your mention of xml-rpc looks like a key point - I didn't know about that and will follow it up to learn more about it - thanks a lot for the info. – Roy Grubb Feb 20 '16 at 11:10
  • 1
    @birgire gave me the info that means I've now blocked all annoying attempts. I disabled xml-rpc and all attempts have ceased. I can live without pingbacks. I'll watch for what else might be affected, but as I've left the htaccess 'login from only my fixed IP' in place it looks good now. – Roy Grubb Feb 21 '16 at 5:22

You can run, but you can't hide - Taylor Wagner

You cannot stop anyone from trying to hack your site. Hackers use many software/bots/techniques in order to find your site, and to hack it (exactly how this works is frankly way above me), and you cannot "hide" from this. These software/bots "guesses" URL's on your site, so it is not that they know where your login page is right-of-the-back. It is basically a guessing a game which continues till the guess is correct.

Whether you like it not, knowingly or unknowingly, you are bombarded by many hacking attempts per day, and you cannot stop it. You can only hope that your current measures (like using good security plugins, strong passwords, keeping PHP and WordPress up-to-date, writing "safe" code and never trusting any type of user inputs, you yourself include) are good enough against the attack. You'll need to remember, no code on no platform or language is ever safe against hacking, every piece of code can be hacked, you can only make it as hard as possible for hackers to gain access to your site through your code or login pages.

Stop worrying about trying to hide from hackers, what you have done so far is about as much as you can do to prevent from being "found". Rather spend your time in making it as hard as you can for someone or something to actually gain access to your site.

  • Thanks Pieter, I appreciate the comment. But if wp-admin and wp-login.php are not even in the blog's directory tree, how do they get to try to log in? What I tried was just physically moving them away. No software changes to make the WP installation look elsewhere. As I see it, there should be no code there that can show a Wordpress login dialog. – Roy Grubb Feb 19 '16 at 6:12
  • As I stated, unfortunatel how these bots exactly work is totally above me. Remember also, these bots does not target your WordPress installation only, but your complete installation on your server. – Pieter Goosen Feb 19 '16 at 6:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.