0

I have a WP site in a shared hosting server (LAMP stack).

Receiving a lot of 404 errors (security plugin log file) for bots looking for non-existing wp-login url (Ex. example.com/en/wp-login.php).

Trying to block them with a rewrite rule like this:

   RewriteCond %{REQUEST_URI} /en/wp-login\.php$
   RewriteRule ^.* - [F]

1) I would need to catch all possible calls to wp-login.php (any subdirectory /en/ /fr/ and so on...)

A condition like this should work?

    RewriteCond %{REQUEST_URI} ^(.*)/wp-login\.php$

2) I would like to save automatically all bad bots IPs in a blacklist as soon as they look up for wp-login.php file.

I've found this script to create a blacklist and lookup for IPs in order to block them:

    RewriteMap    hosts-deny  "txt:/path/to/hosts.deny"
    RewriteCond   "${hosts-deny:%{REMOTE_ADDR}|NOT-FOUND}" "!=NOT-FOUND" [OR]
    RewriteCond   "${hosts-deny:%{REMOTE_HOST}|NOT-FOUND}" "!=NOT-FOUND"
    RewriteRule   "^"  "-"  [F]

Any idea on how to save automatically IPs in deny-hosts file?

Thanks for any advice.

Regards

  • You should probably just use a WordPress firewall plugin or service like Sucuri (the plugin-only version is free). Otherwise you are re-inventing the wheel: all pain and little gain. – Ted Stresen-Reuter Sep 4 '19 at 11:08
  • "how to save automatically IPs in deny-hosts file" - you can't do this with Apache/mod_rewrite alone if that was the intention, you would need PHP (or some external script to call). RewriteMap is a server-only directive - do you have access to the main server config? Do you have evidence that these same IPs are making multiple requests to different URLs on your site? – MrWhite Sep 4 '19 at 11:18
  • 1
    Since this is a pure Apache/mod_rewrite question, I'm wondering if this question would garner more attention on a different stack, perhaps webmasters? – Tom J Nowell Sep 4 '19 at 12:00
  • @TedStresen-Reuter I'm already using a WAF plugin (NinjaFW free edition) but it doesn't have this feature (neither the premium edition). Sucuri free plugin offers only malware scanning and file integrity monitoring. – Roberto Jobet Sep 4 '19 at 13:45
  • @MrWhite Yes, I would definitely need a script to save IPs into host-deny file... do you know any available script for this? I don't have access to the main server config, it's a shared hosting service. Yes, as per log file, IPs are making multiple requests to different URLs on my site. – Roberto Jobet Sep 4 '19 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.