I've been hearing about the recent increase in brute-force WordPress login attempts due to a massive botnet attack. Everything I've read so far indicates that the attack works by just trying different passwords against the "admin" account. If I'm using an alternative login method, such as CAS or some other single sign on provider, is my WordPress installation safe from these attacks, assuming that whatever the SSO provider is doesn't have an easy password on its admin account (if one even exists)?
If CAS is the only login method, I think your blog should be protected. But, the atackers don't care about alternative login methods. They simply send request against
So if you still have an account named "admin", CAS cannot protect your blog. Let's think about the worst case. Assuming you have an account named "admin" with the password "1234", but you use always CAS to login but with a different admin account. The attackers still can access your blog through
wp-login.php and can get access.
You can try to rename the
wp-login.php and test if everything still works. If it so, fine. If not, you have to protect your blog with other additional methods (like login löockdown).