Lots visit on wp-login.php and xmlrpc.php

I am a relative newbie but I think you don’t have to worry if you have WordFence activated. Just block the sites that are doing this and shown on Live Traffic. If you have doubts, you can look up the site on WhoIs. It is pretty confronting the first time you see this happening, I’ll admit.

P.S. Just saw this article when searching for help for another issue. https://codex.www.ads-software.com/Brute_Force_Attacks

I’ve tried to block them for about a hour, it’s pointless. They IPs are different and they don’t seem to have an end.

The thing that got my attention is that they’re just visiting the /wp-login.php file, non stop for about 6-7 hours now, they don’t to login(at least i can’t see them doing so), just visiting the login page. Someone tried to get in, but only 11 times (by putting different usernames/passwords, he even tried the password reset method on some of them).

I found this article, and it says that it is possible for someone to abuse system.multicall method from XML-RPC and try multiple passwords at once(xmlrpc.php is the first file they’re visiting before visiting the wp-login.php, as i can see in Live Traffic).
https://blog.sucuri.net/2015/10/brute-force-amplification-attacks-against-wordpress-xmlrpc.html

Use a plug-in like WPS Hide Login (which I know works well in conjunction with WordFence) to allow you to change the wp-login page to something specific, and then you can add /wp-login.php to the “Immediately Block IPs who access these URLs” list inside the WordFence options.

Thanks for the bluebearmedia, i’ve change the login page and i block everyone that’s visiting ‘/wp-login.php’ or ‘/xmlrpc.php’. They don’t seem to be able to do something for now but on Live Traffic i can see that they keep coming.

Any idea why they’re visiting first ‘/xmlrpc.php’ and then ‘/wp-login.php’ ?

View post on imgur.com

I took this photo earlier in the morning. Since then i’m blocking everyone visiting those two pages.

• This reply was modified 8 years, 6 months ago by mrpowerup.

” i block everyone that’s visiting ‘/wp-login.php’ or ‘/xmlrpc.php’”

Are you saying you’ve added those to the “Block immediately” list and they’re still not showing as being blocked in the Live Traffic?

When it’s working properly, what should appear in the Live Traffic is “NNNNNNNN, United States was blocked: Accessed a banned URL. at nnnnnnnnn.com/wp-login.php” for any link listed in the “immediately block” list.

If that’s not happening, then WF support needs to step in on this one!

• This reply was modified 8 years, 6 months ago by bluebearmedia.

Sorry of the misunderstanding. Everyone is banned instantly, they just keep coming with different IPs.
The photo was taken before i start blocking everyone accessing those two pages.

That’s fine if they use different IPs – they’d all get blocked…. however, with that kind of attack, the blocked IP list will fill up very quickly, causing website resource issues for you.

The better approach for continual wp-login or xmlrpc attacks is block them right at the htaccess level, before they even hit your website. Basically, completely disallow access to the wp-login and xmlrpc URLs, right from htaccess.

(For actual DDOS attacks, you may have to get your host server involved, as they can completely cripple a server by overloading its response resources, independent of any websites on it).

• This reply was modified 8 years, 6 months ago by bluebearmedia.
• This reply was modified 8 years, 6 months ago by bluebearmedia.
• This reply was modified 8 years, 6 months ago by bluebearmedia.

I’ll contact my server’s support as fast as possible.
Is there any guide you could refer me to, so I can properly do what you said ?

Should i just block everyone from it like this, for example ? :

<files wp-login.php>
order allow,deny
deny from all
</files>

Yes – that’s it for the wp-login…. you’d add a similar block for xmlrpc…

But again, that stops IPs from hitting your site with those URLs, but it will not stop an actual DOS/DDOS attack, since a DOS attack is aimed at overloading a web-server’s http response resources regardless of a specific site.

PS – don’t add the wp-login one to htaccess until you’re absolutely sure you can login using an alternate login URL!

(otherwise you risk removing your ability to login to your own site!)

• This reply was modified 8 years, 6 months ago by bluebearmedia.

mrpowerup, that is indeed the usual way, that will block the bots before they get to Wordfence. Just be sure you have access to edit your .htaccess file in case your WP Hide Login plugin quits working and you need to access the normal login URL to admin your WordPress site. As with all this sort of thing, test yourself by making a temporary file on your server, then access without a .htaccess block, then add the .htaccess block and test again.

On the other hand, for fun and education, you can instead add wp-login.php to your WordFENCE “Immediately block IPs that access these URLs” in your Wordfence options. This will act as a “honey pot” and you’ll get to easily see what those bots are doing.

Another tweak: If you’re getting thousands of blocked bot hits via Wordfence, it’s a good idea to modify your Wordfence blocked message so it gives less information and uses less bandwidth. It’s a ridiculously cumbersome and information heavy file that is unneeded once you have some experience with Wordfence, WordPress and .htaccess. The file is /plugins/wordfence/lib/wf503.php I change mine to have NO php, NO live links, and just 25 or so words of explanation. Sadly, wf503.php gets written over each time there is one of the rather numerous Wordfence updates. Hopefully the folks at Wordfence will eventually build in a feature that allows use of custom block message files.

MTN

• This reply was modified 8 years, 6 months ago by mountainguy2.
• This reply was modified 8 years, 6 months ago by mountainguy2.

Thank you guys for your answers.

I’m using a plugin called ‘Rename wp-login.php’ to change it. I have access to FTP in case something goes wrong.

I just had a friend test the ‘Immediately block IPs that access these URLs’ option by accessing the /wp-login.php file. He just got a 404 error and he’s free to continue using the site.

Not sure if this should happen.

PS. I’ve added the following rule to htaccess.

<files wp-login.php>
order allow,deny
deny from all
</files>

<files xmlrpc.php>
order allow,deny
deny from all
</files>

I’m getting a ‘500 Internal Server Error’ message after changing adding those two rules in the htaccess.