I have a serious issue here. Someone is trying Brute force login into my site. I already have plugins to nullify that attack. I give only 3 attempts for login and then it blocks that IP. Problem here is that he has used 1000 different IP's to login into administrator account.
It's a kind of DDoS attack. What is the best solution for this? My site is made with Joomla 3 CMS. Also I am not a security expert.
And in addition, recently I found out that there was a malicious file upload but luckily that was neutralised by a plugin I am using.
I found something surprising. When i was attacked initially with malicious file upload my robots.txt was deleted by them. I was able to stop further upload by modifying .htaccess file but i failed to notice that robots.txt is missing. I think this gave free path to all robots. I am still on the job and searching other loopholes.