I own a self-hosted Wordpress 3.5 blog. I'm working on its security and I'm trying to prevent non-writers from accessing anything admin-ish they shouldn't.
Recently I tried Better Wordpress Security, I really liked some of the htaccess suggestions they have. Primarily the one hiding /wp-admin/ with a unique key, even though it had a few loop holes, you could figure the key using the logout query. Anyway: Assuming my /wp-admin/ and wp-login.php now bring up a 404 not found, I thought automated bots would stop hitting on me. But they didn't. I'm still getting site lockout notifications.
My guess is that Wordpress have other standard routes for remote logins which attackers are still trying to exploit. I can't find any documentation about that or anything in the settings. However, earlier this week one of our writers asked me about writing to our Wordpress through his smartphone. There's this Android/iOS app. So I tried it, and I thought it won't work because the normal route now returns 404. But I actually managed to login successfully in the app. So how does the it work - where does it send the query?
In short I could really use an explanation/article about how Wordpress logins work.
Note: I currently don't have basicauth over /wp-admin/