Preventing Login through Hardening WordPress

I’ve noticed the same thing. Have both Files wp-login.php as well as the entire wp-admin directory locked down, but am still getting notices about failed login attempts from IPs not in the allowed range. Testing access to these areas from external IPs show an apache forbidden, so I’m fairly confident the htaccess is set up correctly.

However, in your case, the email you have listed was generated from Wordfence not Sucuri.

Oh, ok @gilzow. Thanks for commenting. And you’re right … I tagged the wrong plugin.

still a completely legitimate question. Just might explain why the plugin author hasn’t responded yet.

Likely via xmlrpc. That’s where most brute force attempts are happening lately:

https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html

thanks!

@daniel Cid, that’s what I thought too, but I have it blocked as well.

<Files xmlrpc.php>
order deny,allow
deny from all
</Files>

??

Given the .htaccess method for preventing login attacks does not work in WordPress Multi-site, here is the solution I came up with for anyone wishing to truly button down their WPMS Network:

Step 1: create a script and upload it to ./wp-content/mu-plugins/. I called my script “loginBlocker.php“.

Step 2: here is the loginBlocker.php script:

<?php
/**
 * Plugin Name: WordPress Network Login Access & Control
 * Plugin URI: https://example.com/
 * Description: Login request intercept used on all sites in the network.
 * Version: 1.0
 * Author: F.Tredici
 * Author URI: https://example.com/ftredici/
 * License: GPLU
 */

function loginController_func() {

    $authorizedIPs = array(
        '123.456.789.012', // authorized user #1
        '987.654.321.098' // authorized user #2
    );

    if (!in_array($_SERVER['REMOTE_ADDR'], $authorizedIPs)) {
        wp_redirect( 'https://example.com/', 301 );
        exit;
    }

}
add_action('wp_authenticate', 'loginController_func'); // hook for wp-admin
add_action('login_init', 'loginController_func'); // hook for wp-login all actions
?>

Step 3: simply add the IP Address(es) for your authorized login sources to the $authorizedIPs array() and you’ll have better “peace” of mind.

Good luck and happy hacker-blocking.