I'm seeing this quite often:

enter image description here

No OS, same Browser, weird hostname -- they're definitely not real users. Can I do anything to take precautions before they do something?


  • You can restrict access to dashboard by IP. Basically, adding a captcha to login forms also helps against bruteforce attacks (by slowing them down to a crawl).
    – its_me
    Jun 24, 2012 at 4:30

2 Answers 2


There's an app plugin for that, Limit Login Attempts.

Some more info available in this wp beginner post: http://www.wpbeginner.com/plugins/how-and-why-you-should-limit-login-attempts-in-your-wordpress/


Since it looks as there is no referrer you could block the attempts with .htaccess. Something like this:

RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /.*/wp-login\.php.*\ HTTP/ [NC]
RewriteCond %{HTTP_REFERER} ^-?$
RewriteRule .* - [F,NS]

There are different variations on that, you could even just trying using REQUEST_URI instead.

RewriteCond %{REQUEST_URI} wp-login\.php [NC]
RewriteCond %{HTTP_REFERER} ^-?$
RewriteRule .* - [F,NS]

Or if you're the only person logging into your site you could lock it down even more like so:

RewriteCond %{REQUEST_URI} wp-login\.php [NC]
RewriteCond %{REMOTE_ADDR} !^xxx\.xxx\.xxx\.xxx$
RewriteRule .* http://example.com [R=301,L]

Where xxx.xxx.xxx.xxx is your static IP Address. Can be modified to just work for Class A, B, or C if you have a dynamic IP Address.

Where example.com is your TLD. That way they're just redirected to your home page.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.