Excessive Malicious Login Attempts

  • Hello,

    I’ve just launched a site that gets less that 10 views/day. However, it’s received over 10,000 malicious login attempts (!!!) (you read that right!). I’m using Jetpack’s security feature, but this number continues to catapult each night.

    What’s happening here? Is an additional malware plugin required on top of Jetpack?

    Thanks in advance!

Viewing 5 replies - 1 through 5 (of 5 total)

  • I also installed the free version of WordFence. Ik check the logs on a daily base and block the ip-ranges of the malicious logins attemprs.

    Moderator Steven Stern (sterndata)

    (@sterndata)

    Volunteer Forum Moderator

    If you’re not a “world” site, block the countries from which most of the attempts occur. https://www.ads-software.com/plugins/ip-geo-block/

    Hopefully you are using a non-obvious admin user name and a strong password, so these attempts are unlikely to succeed. Still, even serving up all those error pages can use a lot of resources. A couple of ideas to add to Steve’s …
    – You could use a plugin like WP Cerber to limit login attempts and/or change the login url.
    – You could use CloudFlare, and set a couple of page rules to block bad bots from the admin area and default login url …
    *yoursitename.ext/wp-login*
    Browser Integrity Check: On, Security Level: I’m Under Attack, Cache Level: Bypass
    – and –
    *yoursitename.ext/wp-admin*
    Browser Integrity Check: On, Security Level: I’m Under Attack, Cache Level: Bypass

    If you have a more or less static IP address, you can put this in the .htaccess file, replacing ###.###.###.### with your actual IP address. But, if you log in from a bunch of different devices or places then this may not be the best. Just seems easier to ban everything other than what you want to allow. In my case, I am the only one that ever needs to log in and it’s from my PC.

    
<Files wp-login.php>
order deny,allow
deny from all
allow from ###.###.###.###
</Files>
    • This reply was modified 8 years, 4 months ago by MarkRH.
    Thread Starter tickett0

    (@tickett0)

    Thanks everyone for your prompt responses!

    @sterndata: No countries in particular are responsible for the attacks.
    @acstudent: Yes, my username and password are unique. And thanks for your other recommendations!
    @markrh: This is a little over my head, technically speaking ?? but thank you.

    I’m going to start with @staartmees ‘s recommendation of Wordfence; it looks like a very robust program. ?? Will report back if the issues continue!

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘Excessive Malicious Login Attempts’ is closed to new replies.