Checking people against spam DBs at login

I use WordPress ? Limit Login Attempts ? WordPress Plugins

And if you’re on your own server, see https://www.fail2ban.org/wiki/index.php/Main_Page

LLA doesn’t seem to be working since they’re constantly changing IPs (every few tries). I have some sites running that and some running the alternative one, Login Lockdown.

Thanks for the other link, will take a peek.

You can also add additional security by using this plugin

https://www.ads-software.com/extend/plugins/better-wp-security/

there is an option to change the login URL to something else, so the brute force bots can’t abuse the URL

https://yoursite.com/wp-admin

and will return as “page not found”.

Ah, good idea. Will try that one out as well!

LLA doesn’t seem to be working since they’re constantly changing IPs

Doesn’t matter if they are trying the admin account. Limit that account to one login attempt per 1000 hours in the plugin.

If you’re simply getting attempts on all accounts, you want to limit by IP; thus, fail2ban

Most of them are hitting either admin or administrator and doing super-retarded password combos (scooter, 123123123, qwertyuiop).

So I think the combination of those two (I think BWS actually replicates functionality from LLA) should “calm things down” ??

I really appreciate your help!