admin logins while login page is blocked via .htaccess

  • Resolved sunnywinter

    (@sunnywinter)


    9 years, 4 months ago

    Lately we have been receiving a lot of blocked countries and IP’s, as well as many failed login attempts with username admin. We don’t have a username admin, plus we use really long passwords, so, so far so good.

    But what we cannot understand is that we have also blocked the login page of WP with .htaccess and you need to be whitelisted to be able to see the page to login. Yet according to wordfence we still have 100’s of admin username login attempts.

    How is this possible? We tested our login page from varies IP’s and it’s always blocked, except on our office IP’s.

    We are wondering if anybody has an explanation for this?

    https://www.ads-software.com/plugins/wordfence/

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Author WFMattR

    (@wfmattr)

    WordPress has other methods to log in, including through xmlrpc.php, and some plugins may add other ways to log in without wp-login.php — so those are probably what you see in the Wordfence logs.

    Blocking xmlrpc.php with .htaccess is usually not recommended, unless you are sure you do not need any other features that it provides. As for plugins, most should be obvious by the plugins’ function, like plugins that provide membership options, profile enhancements, etc., but if there are any other plugins that you are not sure about, their forums may be able to help.

    Thread Starter sunnywinter

    (@sunnywinter)

    Hi WFMattR,

    Thanks for your fast reply.

    I noticed that on other installations we have for some of our clients, where we use iThemes Security, the xmlrpc.php has been disabled via .htaccess. So we decided to do the same for this particular domain that runs with Wordfence.

    Thanks for pointing this out, hopefully the login attempts will now be reduced to 0.

    Plugin Author WFMattR

    (@wfmattr)

    Great! I’ll mark this “resolved” for now, but if there are still attempts by another method, just let us know what other plugins you are using.

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘admin logins while login page is blocked via .htaccess’ is closed to new replies.