9

We've had Limit Login Attempts installed for some weeks now, and the number of brute force attempts occurring on wp-admin/wp-login is pretty amazing. At first the attempts were all with the username "Admin," which doesn't exist on our site, so I considered it an annoyance but not much of a threat. However, now we're seeing lockouts occurring with other named admin user accounts and I'm completely at a loss of understanding for how the attackers are deducing the usernames of these accounts.

No content on our site is authored by anyone in particular and I can't find any other location on our site where these usernames are publicly published.

Any idea as to how usernames might be discoverable?

9

If you have pretty permalinks enabled WordPress will redirect all calls to /?author=1 to the author archive with the user name, eg.: /author/bob/. And then the visitor will know the author name.

Use Login Lockdown, that plugin does not reset accounts, it will block IP addresses.

2

Clever buggers. I think I am just going to redirect requests to /?author=. Sound reasonable? Something like:

add_action( 'template_redirect', 'my_author_redirect' );
function my_author_redirect() {
    if ( is_author() ) {
        wp_redirect( get_bloginfo( 'url' ), 301 );
        exit;
    }       
}
  • That would be Security by Obscurity. It is better to configure your site so that it doesn't matter if a visitor knows your user name. The LLA plugins is breaking this essential rule; don't go the same way. – fuxia Sep 25 '12 at 16:36
  • @toscho can you elaborate? I don't think the LLA plugin does completely break this rule. It works by initiating an IP lockout after x failed login attempts. It does work even when an attacker knows the user name. What else can be done? Password protect wp-admin...whitelist only certain ip's with .htaccess...make sure all users have strong passwords...? Regardless of any/all of the above, I still like the above redirect option for belt-and-suspenders protection. – user20814 Sep 25 '12 at 17:14
  • Maybe I remember this wrong. I had the impression that a certain user will be locked out after some failed log-in attempts. – fuxia Sep 25 '12 at 18:33
  • Actually, crap you're right. I misspoke. The lockout is based on user. – user20814 Sep 25 '12 at 20:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.