1

I'm a developer (not wordpress though) at a company. We use an EC2 instance to host our wordpress site. I don't actually have an account named "admin", but we do have iThemes Security Pro which permanently bans IPs that attempt to login as the user "admin".

About a week ago, I got a site lockout notification from an IP in Brazil, and one more in Ukraine, where those IPs had tried to gain access through the admin username. I thought it was fine, but in the past few days, I've been getting emails every 15 minutes or so saying another IP has been locked out for trying to login as the user admin.

I thought I would do an IP wide ban for that page for certain IP addresses, but I'm realizing that all recent attacks have been from in the US. And as time goes on, the IPs seem to be getting closer and closer to where the actual server is located (in Oregon). Another thing is, all of these IPs appear to be registered with Amazon, so they might be EC2 instances themselves.

To try and keep up with it, I attempted to put a captcha on the login page using the following plugin. The captcha does appear on my admin login page. However, the bots are somehow able to get past this and attempt to login without completing the captcha.

Does anyone have any advice on what to do to stop this?

1

I've noticed this once myself (can't remember if it was the same plugin). The captcha sat there, but just submitting the form didn't trigger an error and worked perfectly, logging me in.

My #1 advise: use a plugin to rename wp-login.php to something else. It will effectively stop these bots (and delay an attacker that is specifically targeting you, but those are very rare), and you just tell your legitimate users about the new URL to use for login. Obviously, that won't be an option if you have thousands of users, but for your average company site, it is.

You might also want to look into disabling XMLRPC and the REST API if you don't use them, as they provide more attack surface.

Other than that, it sounds like you're already set up quite well, and an active stance on security is always a great starting point.

  • Thanks for this! I appreciate the advice. I went ahead and used a plugin to rename the wp-login page. Hopefully that stops it for now. – Alex Nov 30 '17 at 19:32
  • Looks like I spoke too soon. I changed the URL to login but attempts are being made, now at the new URL. Is this because of XMLRPC and the REST API? Or how would they get this information? – Alex Nov 30 '17 at 20:08
  • Which plugin are you using? Does going to /wp-admin/ as an anonymous user redirect to the new login? API requests aren't going through the login url, but will land on /xmlrpc.php or /wp-json/, so this is something else. – janh Nov 30 '17 at 20:42
  • I'm currently using this plugin, should I be using something different? Also going to /wp-admin/ or /wp-login/ as an anonymous user results in 404 and "you must be logged in as an admin to view this page" – Alex Nov 30 '17 at 20:56
  • No, that one is fine, I'm using it too and am very successful with it. Do you have access to your logs, can you look into what happened in the time between you changing the login URL and the bots adapting? I'm not aware of a bug where that URL is linked, but anything is possible. I would usually include "have you checked your workstation is secure", but I don't see any reason why anyone would bruteforce the login URL if they have control over a PC that does successful logins ;) – janh Nov 30 '17 at 21:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.