User locked out even after renaming login page

  • Resolved SunriseCreative

    (@sunrisecreative)


    9 years, 1 month ago

    I have renamed the wp-login.php page on my websites using the Simple Firewall plugin but I am still receiving emails from Wordfence to say that users are being locked out for exceeding the maximum number of login failures.

    I am wondering how this is possible if my login page is, in effect, invisible? Somehow Wordfence is registering 20 login attempts from someone even though the login page is hidden.

    I would appreciate your thoughts on this.

    https://www.ads-software.com/plugins/wordfence/

Viewing 7 replies - 1 through 7 (of 7 total)
  • Plugin Author WFMattR

    (@wfmattr)

    If login attempts are not coming through wp-login.php, they are most likely coming through xmlrpc.php — the same method used by the WordPress app, plugins like Jetpack, and other features like trackbacks and pingbacks.

    Disabling XML-RPC is possible (there are a number of plugins that do it, such as “Disable XML-RPC”) but it may cause other possible problems. If you decide to disable it, you might want to check out this post first:
    Should you disable XML-RPC on WordPress?

    -Matt R

    Thread Starter SunriseCreative

    (@sunrisecreative)

    Hi Matt,

    Thanks very much for this. I had already read the article and had considered disabling XML-RPC. I’ll give that a go and see what happens.

    Many thanks

    Rob

    Thread Starter SunriseCreative

    (@sunrisecreative)

    With login.php renamed and XML-RPC disabled I am still getting a few emails from Wordfence telling me someone has been locked out for using an invalid username. Nobody apart from me knows the login URL.

    Any thoughts?

    Thread Starter SunriseCreative

    (@sunrisecreative)

    UPDATE: Actually I hadn’t totally disabled XML-RPC after all. I have done so now and will see what happens.

    Plugin Author WFMattR

    (@wfmattr)

    Ok, thanks for the update — if there are any further attempts, just let us know what method you used to disable it. Remember that certain features mentioned in the article won’t work with XML-RPC disabled, and there may be other plugins that could use it too.

    -Matt R

    Thread Starter SunriseCreative

    (@sunrisecreative)

    I have not had any further issues since disabling XML-RPC. Thanks for your help.

    Plugin Author WFMattR

    (@wfmattr)

    Great, thanks for following up!

    -Matt R

Viewing 7 replies - 1 through 7 (of 7 total)
  • The topic ‘User locked out even after renaming login page’ is closed to new replies.