Exceeded log in attempts, but it's not me!

My take: Instead of spending time, just install “WPS Hide Login” and move on to defending yourself against the next attacker in line.

Once you change your login URL, you can use wp-login.php as a honey pot by placing it in the “Immediately Block IPs” list in the Wordfence Options. You’ll probably get some interesting results. This might even help you diagnose what’s happening.

Also sounds like you need a better hosting company, some are really bad, or simply so cheap they can’t afford to do anything more than provide you with a hard drive and saying “have fun.”

Hosting is competitive. You usually get what you pay for.

MTN

Thanks moutainguy!

I’ll try this.

Be sure to whitelist your own IP in Wordfence before you start messing around!

Making honey pots is pretty interesting, if not alarming as you can catch so many bots you might be amazed. It’s also a little depressing to see how many bots slip past the Wordfence “Real Time sort of Security Network.”

If you really want to have fun, put a hidden file link somewhere on your homepage (in footer is probably best), linked to a file that does not exist. Disallow this file name in your robots.txt, and wrap with tags to prevent Google from trying to crawl-index. Use a file name that’ll catch humans examining your website with criminal intent. Add the file name to the Wordfence “Immediately Block URLs” list.

<!--example of code for honey pot fake link bot catcher-->
<!--be sure to disallow the fake file in robots.txt-->
<!--googleoff: index-->
<a rel="nofollow" href="//www.anywebsite.com/passwords-private.html">.</a>
<!--googleon: index-->

Doing this will block people trying to use screen readers, so if your audience includes many folks using readers then trapping is probably not a good idea. Though in my opinion it’s still wise to Disallow a few tempting file names in robots.txt, and put those file names in the Wordfence “Immediately Block” list. Reason being that some pundits say bad bots scan Robots.txt specifically to look for Disallowed file names, then try to hit those files to look for vulnerabilities. So just placing the file name in Robots.txt is somewhat of a honey trap.

Google doesn’t like hidden links, so it’s perhaps best to just run the trap periodically. On the other hand, with all the Google stuff I show above preventing Google crawling the link, I’ve not had a problem with running a trap like this for more than 6 months continuous, though I’ll probably shut it down fairly soon.

MTN