brute force attack with same username but different IPs

Does the username they are submitting exist on your system?

We have the Login Lockdown feature which has a checkbox called “Instantly Lockout Invalid Usernames”. You can enable this and any attempts made using usernames which don’t exist on your site will be locked out.

If you don’t mind disabling the xmlrpc functionality from your site you can enable the pingback protection feature from the firewall rules. But note the caveat is that by doing this you will affect the operation of things which use xmlrpc such as the wordpress app and Jetpack etc.

Hi.

I do want to enable that as real user can make mistake username.

So there no way to block this other than disabling xmlrpc?

Thank you.

Lee

real user can make mistake username

For real users you can enable “Allow Unlock Requests” and they can unlock themselves.

So there no way to block this other than disabling xmlrpc?

You could also blacklist their IP address but as you said if they are always changing it that might not be as effective.

I will also have a think about another feature that can be introduced which may help for such situations.

Hi.

Thanks for the answer.

I don’t want to set up allow unlock requests as customer can complain about that even with one typing mistake.

On my websites, most of attacks are using XMLRPC, sometimes it uses same IPs but so many login requests in very short time. some other cases are trying same user name but different location which I mentioned above.

I think none of security plug-in can block XMLRPC without disabling XMLRPC at the moment.

Maybe blocking the certain username would help if someone is trying to log-in with same username for many times.

Anyway thanks for the help.

Lee