I Installed the plugin Simple Login Lockdown and since a couple of days ago the database is recording over 200 records by day.
I think that is not possible to have my site attacked by so many IP's
Do you think there is something wrong?
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It only takes a minute to sign up.Sign up to join this community
There is currently a botnet active, attacking WordPress and Joomla sites. And probably more. You should see more blocked logins. If you don’t, there is probably something wrong.
But be aware, blocking IP addresses doesn’t help against a bot net with more than 90,000 IP addresses.
And if you do that per plugin avoid Limit Login Attempts. It stores the IPs in a serialized option that has to be unserialized on each request. This is very expensive and slow.
Find a plugin that uses a separate database table or block the IP addresses in your .htaccess like this:
order allow,deny # top 30 IP addresses listed in # http://blog.sucuri.net/2013/04/mass-wordpress-brute-force-attacks-myth-or-reality.html deny from 18.104.22.168 deny from 22.214.171.124 deny from 126.96.36.199 deny from 188.8.131.52 deny from 184.108.40.206 deny from 220.127.116.11 deny from 18.104.22.168 deny from 22.214.171.124 deny from 126.96.36.199 deny from 188.8.131.52 deny from 184.108.40.206 deny from 220.127.116.11 deny from 18.104.22.168 deny from 22.214.171.124 deny from 126.96.36.199 deny from 188.8.131.52 deny from 184.108.40.206 deny from 220.127.116.11 deny from 18.104.22.168 deny from 22.214.171.124 deny from 126.96.36.199 deny from 188.8.131.52 deny from 184.108.40.206 deny from 220.127.116.11 deny from 18.104.22.168 deny from 22.214.171.124 deny from 126.96.36.199 deny from 188.8.131.52 deny from 184.108.40.206 deny from 220.127.116.11 deny from 18.104.22.168 allow from all
Our tag security is also worth a look, especially:
If you have moved
wp-admin or your
wp-login.php these URLs can still be guessed by appending
/admin to the main URL. WordPress will redirect these requests to the correct location.
To stop that behavior you can use a very simple plugin:
<?php # -*- coding: utf-8 -*- /* Plugin Name: No admin short URLs */ remove_action( 'template_redirect', 'wp_redirect_admin_locations', 1000 );
I think this is security by obscurity – nothing serious.
I just released a plugin that does this for you along with blocking No-Referrer requests. (The No-Refrrer block currently does not work for sites installed in a subdirectory).
You can protect your WordPress admin by following methods.