Lock outs

I have used a couple of security plugins.

I am no expert here, but I use some htaccess security and a firewall. I use Bulletproof Security for htaccess and for failed-login lockouts, and I use Wordfence Security for its various features including a firewall. However, I have heard there is at least one plugin that can handle all the above all by itself.

i was checking logins. this was on 404 errors
I got this long list of people all trying to access this file at the same time. I am not quite sure what to make of it. I am new at this. I have my lock out site rather low 4 attempts and it then locks them out for an hour.

Some of that can be eliminated by stopping them ahead of time, and Bulletproof Security has a “Custom Code” editor where you can actually keep undesirable traffic from ever even getting that far. Overall, I add these things to htaccess that way:

## add at top of htaccess
## note: also go set wp-config.php permissions to 0400
# deny wp-config.php
<files wp-config.php>
order allow,deny
deny from all
</files>

## add at end of htaccess
# send certain brute-force login attempts to 403
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_METHOD} =POST
### note change yoursite.com in this next RewriteCond line
### and remove its preceding # to make it work
#RewriteCond %{HTTP_REFERER} !^https://(.*)?.yoursite.com [NC]
RewriteCond %{REQUEST_URI} ^/wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^/wp-admin$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule>

# prevent view of 403.shtml
<Files 403.shtml>
Order allow,deny
Deny from all
</Files>
####

note: Those are in addition to what Bulletproof already does by default.

I looked at my product page where this item is listed and it shows up. I did delete a lot of images the other day to upload the same image but at a smaller and optimize setting. Are all these trying to break into my site?

Likely so, in one way or another, and the fact you are seeing 404s might mean your current security is already stopping them. However, the above code to “send certain brute-force login attempts to 403” can help reduce the 404s while reducing the load on your WordPress installation whenever anyone attempts a login that does not come from a page at your site.

Thanks for the suggestions will look into the plugins
Tom