2

I'm on a security kick right now and my current project is a server with a Wordpress site (that used to be a Joomla site). I sometimes get 50 requests a day to

/wp-login.php (the Wordpress default login page)

or

/administrator (the Joomla default login page)

I obfuscate my login page so they 404 but they continue to give 200 OK instead of 404 Not Found.

I don't like to have people try to hack my website.

I'm thinking about 301 redirecting those requests to the home page hopefully to confuse the brute-force bots. Would there be any drawbacks to such an approach?

I'm also thinking about sending other hack requests there, like author pages, search pages and non-existent plugins.

Improve this question
1
  • 1
    How would a 301 redirect stop hacking better than a 404? It seems to me that as long as there can't be a login attempt at that URL, you are safe from hacking. A 301 vs a 404 wouldn't seem to make a difference as far as security goes.
    – Stephen Ostermiller ♦
    Commented Mar 1, 2018 at 10:31

4 Answers 4

Reset to default
3

The short answer to your question is no, there will be no problem doing that but I'll definitely keep a fake /administrator and /wp-login.php files. That will keep bots and strangers occupied for nothing.

On the other hand, I'd take into consideration:

  • Password protect the real server
  • Limit login attempts
  • Allow access to login files by IP
  • Change default database prefix
  • Disable directory browsing
Improve this answer
9
  • 1
    "keep a fake /administrator and /wp-login.php files" - and return a 200 OK?! You want to get rid of these "brute-force bots" as quickly as possible with the least amount of effort, not let them hang around using your resources for nothing. (?!)
    – MrWhite
    Commented Mar 1, 2018 at 11:16
  • 1
    Yes, "200 OK response". The point is to make them believe it is the real access.
    – Emirodgar
    Commented Mar 1, 2018 at 11:17
  • 1
    A honey pot of sorts
    – Stephen Ostermiller ♦
    Commented Mar 1, 2018 at 11:51
  • 1
    But you don't need a "fake file" to implement a "honey pot", when the trigger to block the request is accessing the URL itself. Keeping the "bots and strangers occupied" is just a waste of your time and resources.
    – MrWhite
    Commented Mar 1, 2018 at 12:57
  • 1
    By hosting fake files, the bots/strangers will only spend more time on your application either investigating it or trying to login. Further, these requests will need to travel the entire application stack which consumes unnecessary resources. A better approach is application white-listing and block these superfluous requests as early as possible. Whether that's at a load balancer, CDN, or WAF.
    – user2320464
    Commented Mar 1, 2018 at 19:48
2

Not Brute Force

50 requests per day is not brute force. That is unless you're password requirements are just two characters in length. Most often these hits are just internet scanners checking for specific credentials and then moving on to the next.

Brute Force Logins

Consider adding a Captcha or better yet some form of two factor authentication. There are a number of two factor options available such as Google Authenticator, Duo Security, etc. Find one that best fits your environment and you'll be set.

404 vs 301

Stick with the RFC standards. If the page doesn't exist return a 404 and if the application owner wants to redirect certain requests to a specific page then use a 301. A determined adversary will not be fooled by your proposed obfuscation techniques while internet scanners and bots are not really a threat unless you're already compromised. This leads me to the next point...

Securing WordPress

WordPress has a large attack surface as evident by the length of the OWASP WordPress Security Implementation Guideline. Your time will be better spent working through that document.

Improve this answer
1
  • This is an interesting answer. You get a +1
    – Coomie
    Commented Mar 2, 2018 at 2:14
1

Use three things to keep your site safe from spam-

Add Captcha, Uncheck the Anyone can register option from settings of Wp site. (If your site has no functionality of user account) Use this Plugin to hide your login page- https://wordpress.org/plugins/wps-hide-login/

as well as if your site username is admin then change it to another because the admin is a very common term and hit by spam tolls and minds...

Improve this answer
3
  • This doesn't answer the question at all. I'm asking about 301 redirects.
    – Coomie
    Commented Mar 2, 2018 at 2:10
  • this plugin helps you with what you want. and one of the easy method for change login address
    – Harpreet Munjal
    Commented Mar 2, 2018 at 2:15
  • 1
    As mentioned in my question, I already obfuscate my login pages. This question is about redirecting the default login page, should it be done or avoided?
    – Coomie
    Commented Mar 2, 2018 at 2:18
1

I wrote an article a couple of years back and it's worth a read, especially the section about "Creating a Strong Complex Password"

10 ways to stop Brute Force attacks in WordPress

Many WP plugins will stop brute force hackers in their tracks however because most plugins work on banning IP addresses after X attempts they may not stop determined password crackers using multiple IP blocks in the thousands.

Most plugins lift bans after X minutes meaning with enough IP addresses you become pretty much immune to these bans unless you opt to use an extremely long duration on those bans. Administrators generally do not use long duration bans because they don’t want to get locked out themselves.

A lot of the current answers are way over complicated

Normally I would suggest fail2ban or hiding wp-login.php but 50 attacks is nothing! with a decent password it would take them many decades. Personally I would keep things simple and just install... Loginizer for WordPress.

It is used by millions of sites and by installing it, it will automatically ban bad users by IP address for a few hours, a day, weeks, months or even years. Also, it will show you how many attacks it has blocked.

Improve this answer
1
  • This doesn't really answer my question. As mentioned in the question, I obfuscate the login page so password complexity and bans are way off topic.
    – Coomie
    Commented Mar 2, 2018 at 2:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.