2

Some time ago I installed the Limit Login Attempts Reloaded plugin and it's working fine.

However because I was getting SO many unauthorized login attempts I also implemented an .htaccess password on the wp-login.php file itself, and that does work - when I go to either /wp-login.php or /wp-admin (assuming I'm not already logged in), I get my first level .htaccess password required dialog and have to enter the correct username and password (which FWIW is completely different from any of our WP usernames/passwords).

Once I enter the correct credentials into the dialog box, then and only then do I get the wp-login.php page to login with my WP username and password.

I have a few other (non-admin) users to whom I've given this higher-level login info. Both the username and password required by .htaccess are extremely long and strong, and highly unlikely to be 'guessed' by anyone so I would expect to see ONLY authorized user logins.

BUT I'm still getting repeated unauthorized attempts on my wp-login page - not as many, but it does still occur according to the LLAR plugin......In the logs it shows the attempts as coming in via wp-login, not XMLRPC (which I've disabled).

So my question is: Is there anyway someone/bot could by bypassing the .htaccess directive on wp-login.php? Or is the ONLY possible answer that the first-level login credentials have been discovered somehow? (Lack of user security?).

If the ONLY way is via a discovered first-level login, I can change that and advise my users, but if there is some other way that I am missing, then doing that won't be effective.

Thoughts?

Improve this question
2
  • "according to the LLAR plugin" - What do your server's access logs show? What response do you see in the logs? How exactly are you blocking access in .htaccess? Is there another way to login to WP bypassing wp-login.php? Although "wp-login" is reported as the entry point? It should not be possible to bypass HTTP Auth unless the server is compromised (or there is a config error in how it is implemented). Compromised login credentials sounds unlikely, but possible. What's the timescale between implementing HTTP Auth and apparently seeing this bypassed?
    – MrWhite
    Nov 21, 2019 at 8:36
  • @MrWhite 1) Server access logs are huge and unwieldy because we have a lot of domains sharing the same hosting account so while I download them, we don't have a good way to make use of them....yet. 2) Blocking the page in .htaccess using <filesmatch "wp-login.php">. 3) Timescale was an immediate significant drop in attempts, but in less than 48 hours I continued to see some sporadic attempts to login reported by LLAR....so my best guess is compromised credentials to the [.htaccess] username and password, I'm just trying to eliminate other possibilities before I get cranky with my users.
    – Trisha
    Nov 22, 2019 at 5:09

1 Answer 1

Reset to default
1

As long as a plugin is blocking excess login attempts, then I am not sure that additional protection is needed. The plugin should be protecting against the attempts at credential guessing.

There will always be login attempts on sites, even if they aren't WP sites. You could look at your access logs (filtering by a 40x result code) and see tons of attempts to access things that aren't available on your site. Part of the way things are.

As long as you are blocking excess logins, and have strong passwords for your accounts, I don't see the advantage of an additional layer of security (via htaccess passwords).

Those login attempts will always be happening. Your defense against them is the plugin that limits login attempts, and strong passwords.

Improve this answer
4
  • Thank you @rick-hellewell I would normally agree with you but the sheer number of attempts was truly overwhelming, hundreds each hour....initially I implemented this as a temporary measure figuring whomever was behind it would just go away eventually, but that hasn't happened, although we get far fewer attempts now. On a different site I manage (different server too) someone or bot actually did crack a few very strong passwords and then did significant damage that took months to recover from, so now I'm extra-cautious....ok, paranoid maybe.
    – Trisha
    Nov 22, 2019 at 5:16
  • There are security plugins that will automatically blacklist IP addresses with too many login attempts. I think one is "WP Cerber Security", another is from "Securi". Perhaps those might be appropriate for your site. Interesting that a very strong password was cracked - maybe not as strong as you thought? Recovering from a hack attempt is usually easy, but I've got one client that keeps getting re-infected, and haven't figured out how. Luckily, the attack is a 'link-adder' that doesn't work properly, so I only get extra files and inserted code; no damage.
    – Rick Hellewell
    Nov 22, 2019 at 21:49
  • 1
    I just found this resource: owasp.org/index.php/… . There may be some help in there...
    – Rick Hellewell
    Nov 22, 2019 at 22:41
  • Thanks @rick-hellewell that's even more extensive than the old Codex page I've long used as a reference, it will take me some time to go through it, but I most certainly will!
    – Trisha
    Nov 25, 2019 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.