7564 Malicious login attempts

Try a combination of:

Basic Options – Security Level $: Lockdown
Login Security Options – Immediately lock out invalid usernames

I posted this in another thread, so I’ll start off with saying I have no association with them. Bad Behavior would be a good start. With http:BL working it will fend off a lot of stuff automatically, and ou can use its log to see what IP’s are trying and what their attempted payload is. The password guesses are often hilariously bad. Don’t be that stupid about choosing a login password and you’ll be far above the low-hanging fruit.

When you get a login attempt, if it is a username you don’t use, add it to the list in Options that automatically block someone trying it.

But first; Immediately click Block this IP. Then click on Block This Network and add it to the Advanced Blocking list. Label it so you can decide later if you want to stop blocking that IP range. That page will show if there are further attempts, usually there aren’t, but some I{ ranges turn out to be havens for login bandits.

@Barnez
Great thoughts. I also check the box for “Don’t let WordPress reveal valid users in login errors” so the bad guys don’t see when they guess an actual username.

@seedy
I haven’t used that plugin so I can’t speak to that one but you are spot on about password complexity being a major issue. Wordfence has a setting on the options page to “force Admins and Publishers to use strong passwords” which I highly recommend. It keeps users from using ‘password1’ or ‘qwerty’ or other easily guessed ones. Remember a good password has upper and lowercase letters, symbols, and numbers. I know it makes it tougher to remember, but recovering a hacked site is worse!

As an aside, at a major site I manage we once blocked every country but the US. I love Wordfence’s ability to redirect them where I want since we sent them to our www site instead, retaining the traffic. I was voted down from sending them somewhere more fun. ??

Let me know if you have any other questions..

tim

I use a combo of this sensible idea and my own invented words…

https://xkcd.com/936/

Tim, I can see the reason country blocking is part of premium, because effectively that’s what ends up happening eventually. My issue is that I do have items of global interest to share, so I do the flyshit/pepper granular approach.

BTW, I do appreciate Wordfence for all the power and info it gives me.

LOL @ the cartoon Stealing that for another discussion (with citation of discovery of course!)

@preston
Has trying he suggestions we provided helped?

tim