i am trying to ban a spam bot IP from my wordpress, since the "limit login attempts" extension mails me multiple times every day, that the same IP is trying to login. so i added the following to the .htaccess file in the wordpress root:

order allow,deny
allow from all
deny from x.x.x.x

with x.x.x.x being the IP of the bot. still the bot is trying to login. so i tried my own IP and found out, that the htaccess order does only block the css of the login page. mywordpress.com/wp-login.php still shows the login form, though without any styling, but the bot can still try to gain access.

so how can i really block the entire site including the backend from certain IPs?

  • Your code should do the trick (tried your code on some of my installs). Are there any plugins that might influence the htaccess file? Does the bot have any user agent? – Pieter Oct 17 '12 at 12:00
  • yes it does: [26/Oct/2012:05:06:13 +0200] "POST /wp-login.php HTTP/1.1" 200 3412 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv: Gecko/20090824 Firefox/3.5.3 GTB5" how can this help me? – mcnesium Oct 26 '12 at 11:10
  • this must be some php issue. i just checked with my own ip again, while being logged in the backend. after i blocked myself and reloaded the backend (/wp-admin/…), the dashboard showed up without some of the css and javascript features working, but not all of it: !screenshot. – mcnesium Oct 29 '12 at 12:51

I think you've got it backwards. Try

order allow,deny
deny from x.x.x.x
allow from all

That should block all URLs from that IP.

And Limit Login Attempts http://wordpress.org/extend/plugins/limit-login-attempts/ can be set to not email you with each lockout. Set the lockout timeouts to 9999 hours, too, which is the maximum setting.

If things still don't work, deactivate other plugins that might be intercepting calls to or reads of .htaccess.

  • i deactivated all plugins but LLA, still the same effect. after i enter my correct login data, i get the forbidden page. but the login form is still reachable. i tried different computers, so it's no cache-issue. – mcnesium Oct 18 '12 at 13:49
  • my strategy was to get the mails to learn about spam-IDs to filter them out entirely. this bot left spam comments on my posts too, which i could block using that htaccess order. – mcnesium Oct 18 '12 at 13:56

You should also consider blocking entire ranges of IP addresses if they come from countries that aren't a part of your normal reader base. Russia, China, and some countries in Euorpe are notorious for turining a blind eye to spammers and other bots that can wreak havock on your system. Just locate the offending IP in your log file and look it up in whois. The whois record should list the ip range it's a part of and then block it.

Edit - If you look at your log files you can easily tell who the offenders are. I had to ban hundreds of IP ranges because it severely effected the performance of my server (over 500K unique non spam/bot users a month).

  • besides that this doesn't help to solve my problem at all, I need to tell you that my normal reader base is likely to come especially from europe, since i live in europe. so your approach seems kinda prejudiced… – mcnesium Oct 26 '12 at 12:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.