1

After being attacked many times and compromised I installed Sucuri for monitoring. Seeing how many times a day I was being brute forced, I decided to turn off the wp login page, but I still get notifications of a failed login.

How is this possible if there's no login page to speak of on my site? How can bots access that page or try to login if it is not present?

Improve this question
6
  • 3
    Because they are arbitrarily hammering your website looking for it. I don't run a Wordpress site and I still see the same access attempts for WP login that you do, in a completely different domain. Basically, an attempt to access a nonexistent URI is not a cause for alarm, we're all being scanned.
    – Fiasco Labs
    Jun 26, 2016 at 21:56
  • Failed login, or failed access to the wp-login.php file?
    – Tim Malone
    Jun 26, 2016 at 22:59
  • Afaik it is for example also - and even more effective - possible to drop login requests via xmlrpc.php. Unfortunally I have no link at hand but it should be easy to google....
    – Wooz
    Jun 27, 2016 at 13:21
  • Hello guys, ok i downloaded the plugin Wooz suggested to disable xmlrpc.php and i hope it does the trick. I will update you here in a few days.
    – The Architect
    Jun 28, 2016 at 3:18
  • Actually I did not exactly mean a plugin - I just wanted to hint to the xmlrpc problem in general. A radical alternative for example would have been to deny access to the xmlrpc.php. But if a plugin does the trick then everything is fine. Maybe, if you are happy with the plugin, you could tell which one you choosed?
    – Wooz
    Jul 1, 2016 at 16:01

1 Answer 1

Reset to default
1

Bots are endlessly looking for ways to get into your Wordpress site and there are many more than just the standard 'wp-login.php' address.

There is also the /wp-admin/ in addition to wp-login.php, as well as comment sections, and other user profile pages that all may or may not be serving one way or another to approach the user login.

The bots could also potentially have discovered your new login address, especially if you used something in the phrasing such as "admin" "login" "logon" etc.

I would suggest blocking IP addresses after a certain number of failed attempts to login. It will not stop all the bots, but at least you are pro-actively defending your site from brute force attacks.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.