Difference in server load

Hi,

Just got a brute force attack which lasted 5.5 hours. Didn’t get in of course, waste of time.

I’m using now this in my htaccess which caught all the wp-login.php requests before your plugin did.

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^loginpage$ /wp-login.php?hfju7hdjto0jf6hd3[CO=accesss:666:mydomain.com,R,L]
RewriteCond %{QUERY_STRING} !^hfju7hdjto0jf6hd3
RewriteCond %{QUERY_STRING} !^action=logout
#RewriteCond %{QUERY_STRING} !^action=rp
#RewriteCond %{QUERY_STRING} !^action=register
#RewriteCond %{QUERY_STRING} !^action=postpass
RewriteCond %{QUERY_STRING} !^step=upgrade_db
RewriteCond %{HTTP_COOKIE} !^.*accesss=666.*$
RewriteRule ^wp-login.php$ https://127.0.0.1/ [L,R=301]
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

So they were all sent to 127.0.0.1 because I renamed the login page as well. Then I was thinking what gives the least server load, the above code or this one?

<Files wp-login.php>
Order Deny,Allow
Deny from All
Allow from x.x.x.x
</Files>

I actually want to make it in such a way that the requests will end up in the plugin’s firewall log (so the requests are caught by NF) but I’ll get an email that a brute force attack is going on and maybe also adding the last block of code to the htaccess and remove it automatically after 3 hours or so.

But if there is no difference in server load I could keep the redirect to 127.0.0.1 as well. Still I like to idea to get an email when things are going on (which I am going to add anyway ;))

https://www.ads-software.com/plugins/ninjafirewall/