The goal of my request isn’t to prevent the brute force attempts themselves (which of course would be nice) but to prevent servers from getting overloaded by them, and in that regard I believe it will alleviate what I’ve been seeing. I’m going to give that plugin a try.
Thanks for the links and info!
If you are trying to reduce load on your servers that plugin is going to make load worse during a brute force attack. The main problem is that the attacks come from multiple IP addresses usually around 10 or 12 per IP then they hit you from another IP. Limit login attempts locks out an IP after a set number of failed attempts but wont’t protect you from the next 10 tries from another IP.
It also stores the IPs as a serialized array and everytime a failed request is made it requires a call to the database and PHP resources to unserialize the data then serialize and write back to the db.
I think blocking No-Referrer requests via the web server either Apache or Nginx is the best way to prevent the attempts. The bots don’t normally get to wp-login.php via a redirect from /wp-admin, they usually hit wp-login.php directly with a POST request containing the username and password attempt. If you block direct access without a referrer it stops the attempts.
You can also do this via PHP and WordPress but every attempt will still load the WordPress bootstrap.
