How can I store IP addresses which try to brute-force the login section or to login too frequent too fast?

I need to store all IPs, then use them in another application, sort of like a learning routine.


Here's a scenario (pseudo-code):

function my_wp_login_failed($username) {
add_action('wp_login_failed', 'my_wp_login_failed');

How can I do this for all attack vectors?


I need IP addresses trying to access the site more than X times get blocked for at least Y time. The initial phase will simply store these IP addresses.


I have found this plugin - https://plugins.trac.wordpress.org/browser/wp-fail2ban/trunk/wp-fail2ban.php - which might do the job. I will need to rewrite it in order to pass the IP information to a database or a flat file.

  • 1
    That may not be a good idea. Imagine if there's a DDoS attack. Your Database will be overwhelmed. – Fayaz Jul 30 '18 at 15:20
  • I know, but this is an experimental app. The code would eventually pass all IPs to a third-party app. – Ciprian Jul 30 '18 at 15:21
  • @Fayaz and he can clear that db table after some time, I guess... – Krzysiek Dróżdż Jul 30 '18 at 15:34
  • @KrzysiekDróżdż yes, this is a proof of concept. All data gets written to a log file on the server. It might not be the final behaviour, but I need it like this for now. – Ciprian Jul 30 '18 at 15:39

You can use wp_login_failed action for that purpose... It's called at the end of wp_authenticate, if user credentials were incorrect.

function my_log_brute_force( $username ) {
    $ip_address = $_SERVER['REMOTE_ADDR'];
    // store that info somewhere
    file_put_contents( 'bf-log.txt', date('c') . "\t{$ip_address}\t{$username}\n", FILE_APPEND );
add_action( 'wp_login_failed', 'my_log_brute_force' );

Also this article may be helpful: Getting real IP address in PHP

  • I have added a sample code, similar to yours. What about other attack vectors? The comment form? The registration form? The forgot password form? Can I do the same using a similar action? I want to have all bases covered. – Ciprian Jul 30 '18 at 15:48
  • 1
    What kind of attacks? Brute-force attacks trying to guess password? You don't have to secure other forms - WordPress always uses the same function to check credentials, so wp_login_failed will get called... – Krzysiek Dróżdż Jul 30 '18 at 15:49
  • I am trying to detect frequent/fast attacks from the same IP. Let's say an IP address is trying to post 100 comments per second. How can I capture that IP address? Or an IP trying to create an account? – Ciprian Jul 30 '18 at 15:50
  • You have to check for all of such attacks and add them to the log. You can also try to monitor all requests - real users don't generate to many requests per second... – Krzysiek Dróżdż Jul 30 '18 at 15:52
  • I know, that's why I was asking. I have updated my question with: "I need IP addresses trying to access the site more than X times get blocked for at least Y time. The initial phase will simply store these IP addresses." Your answer only covers one scenario. – Ciprian Jul 30 '18 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.