My question is similar to this one, except that the automatted login attempts are using not nonsensical user names, but real ones that were used in the past on this site. It became infected with a malicious redirect and I reinstalled it. It's a Wordpress site, and I now use the Cerber security plugin for protection, which blocks IP-addresses (entire subnet) from logins with these old user names, which I blacklisted, plus some common ones like admin, administrator etc. These login attempts are slowly increasing in number, and I'm wondering if it's any more dangerous than for the other question that I cited and if there's anything more I could/should do about it.
3
-
"real ones that were used in the past" - Are these usernames no longer valid, or are they still in use by real users? If they are still in use, presumably the passwords have since been changed? How many login attempts are we talking about?– DocRootApr 20, 2020 at 16:33
-
No these usernames are no longer valid, and I blacklisted them. IPs trying to login with non-existing user names are blocked, and number of permitted login attempts is limited to 5 in 30 minutes. Number of login attempts is 30 - 100 - hard to tell exactly because the reports are a bit confusing. I get notifications stating numbers of active lockouts (not login attempts). Adding up all the ones from today, it's just above 100. Lines in the summary report stating a failed login attempt are 34. However, number of failed login attempts and active lockouts should actually be the same.– Bennypr0faneApr 20, 2020 at 18:07
-
What kind of error is reported to the person trying to log in? Does it simply say "wrong password" or is it more generic? As is mentioned in the post you linked to, the more generic the message, the better. You might also try renaming the old accounts as and extra level of security.– TreborApr 21, 2020 at 2:11
Add a comment
|
1 Answer
These are 2 methods I use. There may be other better ones but these are 2 quick ones that I've used successfully.
Method 1
You could enable 2 Factor Authentication.
This is a quick solution for such instances when you're under brute force attacks. Right now I know of 2 options to do this:
If you're already using Jetpack, you can enable this option from Jetpack > Settings > scroll to the bottom. You can see a few more details at Jetpack.com. Using this option you'll have to login using your Wordpress.com account. This is the one I use.
Alternatively, you can check the suggested plugins at the bottom of this page Wordpress.org - Two Factor Authetication. I haven't used this method.
I'm not sure of the drawbacks to this method. Probably it being more difficult to log in, having to depend on your phone, and going for the easy way rather than understanding how to protect your website at a deeper level.
Method 2
The second is via "Basic Authentication", where you add an extra layer of security on /wp-admin. It's a prompt requiring another user/password.
I believe that setting this up depends on how you're serving your website - apache, nginx, apache+cpanel, etc.
I don't know your set up. To find how to easily set this up, you can google something like htpasswd wordpress apache, htpasswd wordpress nginx, htpasswd wordpress cpanel, etc.
