Stop username admin lockout notifications

  • Zoee

    (@epixmedia)


    8 years ago

    Hi, is it possible to keep getting all other lockout notifications but stop the ones for the username “admin” setting. We want to auto block these attempts but we don’t need to be notified.

    If not is this a feature of pro?

    Thanks!

Viewing 3 replies - 1 through 3 (of 3 total)
  • pronl

    (@pronl)

    @epixmedia

    No, it’s not possible to only disable lockout email notifications which are the result of invalid login attempts by the admin user. And it’s also not a PRO feature.

    If everything is properly configured you should by default get 3 (configurable) temporary lockouts after which the IP address attempting to login as admin is permanently banned (in the .htaccess file if using Apache web server).
    (Assuming the Automatically ban “admin” user setting in the Local Brute Force Protection module is enabled. Note (permanent) “ban” should read (temporary) “lockout”).

    If the attacker switches to another IP after being banned, another 3 temporary lockouts will occur after which the new IP will be banned as well etc etc

    Check the Logs page and try and determin whether these host lockouts are occurring as a result of invalid (admin) login attempts from a single IP address or from multiple IP addresses. Another way to check is to look at the IP address in the lockout notification emails received.

    In short when the plugin is properly configured you should by default only get 3 host lockout emails per IP (which is attempting to login as admin).
    How many host lockout emails are you receiving ?

    Also does the admin user actually exist ?

    What web server are you using ? (Apache, NGINX, MS IIS)

    If properly configured it is possible to minimize these host lockout email notifications. Possibly to 0 or just 1 per IP.

    ElderP65

    (@elderp65)

    I have deleted my “admin” ID and would like to permanently ban anyone trying to login with this id. Since it doesn’t exist, anyone trying to use it is obviously a hacker.

    I have four sites that I manage where I recently added iThemes . They each get hammered daily with someone attempting to use the “admin” login (“admin” does not exist on any site).

    How about adding an option to redirect any attempt to login with the “admin” user to some obscure server and let them play there?

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Stop username admin lockout notifications’ is closed to new replies.