I'm in the process of adding yet another layer of security to some of my WordPress installs, since some of my customers sites use shared hosting, and generally they do not ban users for brute force attempts on the WordPress login pages. Generally I would use fail2ban but sadly these accounts are on shared hosting and not in the position to make use of it.
I know there are WordPress plug-ins out there to prevent brute force but would rather a simple
.htaccess method that will pretty much block all attempts via the
So I came up with this simple code that will block users other than myself, or at least those not using my ISP.
<FilesMatch "wp-login.php"> deny from all allow from .isp.example.com </FilesMatch>
The code works great however I would expect to see a 403 forbidden yet Firebug reveals 302 temporarily moved, the header status return looks like this:
HTTP/1.1 302 Moved Temporarily Date: Thu, 31 Dec 2015 00:24:15 GMT Server: Apache X-Powered-By: PHP/5.3.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Link: <http://www.example.com/wp-json/>; rel="https://api.w.org/" Location: http://www.example.com/wp-login.php Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked
While this does seem to stop the brute attacks it causes unnecessary multiple access attempts on the server, for example here is what FireBug looks like:
Other than using a redirect rather than deny is there anything I can do about this??
- How can I return 403 with deny (not redirect)
- Is this normal? or should I contact the web host?