1

I work with Wordpress since years and I use to protect my client websites with iTheme Security + Wordfence keeping core and plugins always updated and using only Themes or Plugin from secure markets.

For example with the Live Traffic tool in the Wordfence plugin I see every minutes bot or humans trying to visit random pages and files in the websites.

I change the wp-admin name to make it more secure but anyway bots or hackers trying to login without success...

Do you have any suggestion?

How can I protect my websites better than this?

Any suggestion about how to change the folders permissions?

Thanks in advice.

  • not sure what is actually the question here... what does security plugins have to do with folder permissions? .... changing the name of the admin directory makes your install so much slightly more secure it is not even worth thinking about it as a security measure. Force all users to use strong passwords, and stop looking at the "attack' logs. Your biggest security problem seems to be that because you buy your themes/plugins from markets, they are better coded. The market itself is not important, buy code only from good developers. – Mark Kaplun Dec 30 '16 at 11:13
  • @MarkKaplun thanks for the anwer. I am asking why even if i change the admin directory bots can access the new directory and try to login? For example daily I have a list of user that try to login with the "admin" or "Webmaster" username without succces? How can this happen? – A.Casa Dec 30 '16 at 11:19
  • because login is not related to the admin directory. there are at least two urls from which a login can be attempted, the login page and the xml-rpc. Seriously, all sites are constantly under such simple attack, if you have good passwords you might as well ignore them as they make more noise than harm. – Mark Kaplun Dec 30 '16 at 11:25
  • @MarkKaplun is possible to "hide" the xml-rpc? – A.Casa Dec 30 '16 at 11:31
  • I usually use this in the .htacces file # Block WordPress xmlrpc.php requests <Files xmlrpc.php> order deny,allow deny from all allow from 123.123.123.123 </Files> – A.Casa Dec 30 '16 at 11:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.