Hey @patrickhealy,
I had linked to an article I wrote on protecting against these type of attacks, but WordPress doesn’t want external sources posted here.
Basically I’d recommend not relying on WordPress login limit or security plugins for this type of attack. If you’re on a Linux web-host, you can just use some simple .htaccess rules to block everyone out of your admin but yourself.
The current brute force attacks that have been taking place, are not POST’ing to the wp-login.php script with a proper referer being passed. So if you require a proper referer to be passed, this can block those. Then you can lock it down even further with IP allow rules to only allow yourself in.
If your domain name was example.com, and your IP addresses that needed to access the WordPress admin were 123.123.123.123 and 123.123.123.124 I’d recommend using these rules:
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{HTTP_REFERER} !^https://(.*)?example\.com [NC]
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^123\.123\.123\.123$
RewriteCond %{REMOTE_ADDR} !^123\.123\.123\.124$
RewriteRule ^(.*)$ - [F]
</IfModule>
An even further level of protection would be to employ a secondary .htaccess password, you would want to fully password protect the /wp-admin directory, and then in your .htaccess file in the WordPress root directory you’d also add that password protection to your wp-login.php script with these rules:
<FilesMatch "wp-login.php">
AuthType Basic
AuthName "Secure Area"
AuthUserFile "/home/example/.htpasswds/public_html/wp-admin/passwd"
require valid-user
</FilesMatch>
Also using the .htaccess file you can Google for “country IP blocks” and then simply block entire countries that you don’t want to have access as well.
Once you start locking down and securing WordPress this way, I’d then recommend simply checking on your website’s access-logs every so often, if one IP has been continually hitting your wp-login.php script and getting 403 access denied errors from the .htaccess rules, you could then start to block them at your server’s firewall to prevent any further attempts from even making it to the site.
– Jacob
