s0litaire

I have those settings already, except i only lock them out for 2 weeks.

The initial flurry of login attempts, when i put everything back, seems to have stopped. Not had any in the past 8 hours. Looks like it’s over for now.

I’m the only user on the system and can connect via ssh direct to the server if required.

Might look into getting a login page mask plugin if it happens again.

I’m on a tight budget (i.e. Zero $￡€!) so i’ll check out the free plugins for changing the login page.

thanks for the info.

Have you recently updated WordPress or any plugins?

Wordfence should give you the option to compare the differences in the new file with a previous version?

It might just be a version number change. (that can be enough to flag it is suspicious).

If it’s anything more, (like a few more extra lines of code), then it might be worth re-naming the affected files and checking with a know up to date version of the files from the WordPress site.

It can take the Wordfence a few hours to get up to date file details.

Looks like I’ll have to stop the wordfence notification messages.

After removing the log-on for 12h i have just replaced it and they are starting again.

I blame myself. ?? I’m currently using GoDaddy hosting. lol! 8D

I’m planning on moving to a Digital Ocean server that I’ve already using for another site, quite soon. So it looks like I’ll be doing the migration a lot sooner than expected!

Just getting annoying now!

They are changing the user names in attempt to log in. (looks like at least 2 separate scripts are attempting to gain access going by the timings of them.

I’ve temporarily changed the login page to another name (and edited the wp-login.php to accommodate the changed name!) and xmlrpc.php file.

I can still log in as the administrator rights user and everything is fine so far.

It’s only a temp fix (I know it’s an ugly terrible way to do it but it’s just a test). I’ll replace the original back in a few hours, just to see if they give up.

Thanks just a bit worrying

They have moved on to trying to login using the non-existent user name ‘test’ so it’s just very annoying getting 200+ emails since i first posted this.

Also I’ve no “generic” (i.e. admin, test, default, editor, administrator, webmaster, user1 etc…etc…) user names in my database.

So I guess it’s just a case of waiting it out and keeping things upto date.

^_^