0

I manage a Wordpress site. The regular site (outside the admin login) is normal, but when I went to log in to the admin panel today, and got this brute force protection screen: brute force prevention screen

I don't have any brute force protection plugins installed, and I've never seen this screen before, so I'm concerned that this is a hack of some kind. The source of the page is this:

<html>
<head>
    <title>Wordpress Anti Bruteforce</title>

    <style type="text/css">

        .center {
            position: fixed;
            top: 50%;
            left: 50%;
            transform: translate(-50%, -50%);
            text-align: center;
        }

        .button-container {
            margin-top: 30px;
        }

        .text {
            margin-top: 30px;
            font-family: "Helvetica Neue",Helvetica,Arial,sans-serif;
        }

        .button-container {
            padding-top: 10px;
        }

        .button {
            font-size: 20px;
            height: 50px;
            width: 300px;
        }

        #logo {
            width: 540px;
            height: 122px;
            background: url('...')
            /* removed this for brevity - contains a Wordpress logo in svg as a data: url */
        }

    </style>
</head>
<body>

<div class="center">

    <div id="logo"></div>

    <h4 class="text">Please click the Login button to confirm you aren't a bot.</h4>

    <div class="button-container">
        <input type="button" class="button" onclick="_login()" value="Login to Wordpress" />
    </div>

</div>

<script language="javascript">

    function _login() {

        document.cookie = "antibot=* 15 character alphanumeric code here *; expires=Thu, 18 Dec 2026 12:00:00 UTC; path=/";

        location.reload();

    }

</script>
</body>

Is this likely a hack, or should I just go ahead and click the button? The plugins I have installed are Contact Form 7, The Events Calendar, and mb.miniAudioPlayer.

3 Answers 3

1

It looks like a poorly coded hosting-side protection.

I say poorly coded because "Wordpress" is misspelled and it uses <script language="javascript">.

Ask your host. This is definitely not WordPress native behaviour.

Also, check your document root, as the file seems to be self-contained. It might be an extra HTML file in your document root. Use your hosting panel File Manager, or an (S)FTP app, such as WinSCP or FileZilla.

2
  • Got in touch with my hosting provider and this was indeed put in place by them due to a large number of attacks on wp-login files. Aug 2, 2018 at 18:35
  • So you soled your problem. You can accept this answer if it helped you or if it matched your issue.
    – Ciprian
    Aug 3, 2018 at 8:20
0

Do you have JetPack activated? It has some brute-force capabilities.

I'd also suggest looking at the wp-login.php code (via your file manager) to see if it has changed. Look for dates different than the rest of them.

You could also reinstall the WP software manually.

The code will reload the current page - I'm assuming it is the wp-login.php page. That's why you need to check that pages' code....to see if it has changed.

By itself, the code you posted is benign. Except for the part where it reloads the current page, which might be 'bad'.

0

1) No, WP does not have built in brute force prevention, though such protection should be considered.

2) Keep in mind, this could be something a theme has installed as well, or a must-use plugin from the hosting provider.

3) That said, SVGs have some security issues, so being sure that's an unaltered WP svg file would be good to know. Here is a good read on why they are omitted from WP media uploader for that reason.


In addition to checking wp-login.php as mentioned by Rick, inspect both the theme's functions.php and the directory structure in general. A search for the following strings may help pinpoint files:

 add_action( 'login_form, 
 add_action( 'login_footer 
 add_filter( 'login_headerurl, 
 add_filter( 'login_headertitle, 
 add_filter( 'login_message, 
 add_filter( 'login_errors 
 add_action( 'login_enqueue_scripts, 
 add_action( 'login_head.

If you want to check the DB for plugins, they are saved in

(table) <prefix>_options 
    (row) option_name
       active_plugins   

If you have db access, you can disable all plugins with the following SQL: UPDATE wp_options SET option_value = 'a:0:{}' WHERE option_name = 'active_plugins'; Source and more info on SQL

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.