Attempts to log in to wp-login despite bruteforce protection by / wp-admin /

Hi @thomasius1, thanks for getting in touch.

By the protection you speak of on /wp-admin/ do you mean you have hidden or changed your URL?

It can be frustrating to see many login attempts such as this, especially if there seems to be no logical reason, but this is actually quite a normal occurrence.

You might find the following blog post interesting: https://www.wordfence.com/blog/2018/03/ask-wordfence-why-is-an-insignificant-site-like-mine-being-attacked/

Wordfence, as an endpoint firewall cannot stop a bot or human from trying to visit your website altogether, but rather deal with the visits appropriately when they happen.

My general advice is that Wordfence does all of the important blocking for you automatically so you don’t have to, but if you wish to make your brute force or rate limiting rules a little stricter so that they can’t retry as frequently, for example reducing login failures to 3 or 5 instead of 20, you might find the following links useful to learn some more:

https://www.wordfence.com/help/firewall/brute-force/
https://www.wordfence.com/help/firewall/rate-limiting/

Thanks,

Peter.

Hi Peter,
I mean that the / wp-admin / folder is protected. When calling up wp-login.php, you first have to enter a password and user name before doing the WordPress login.

Here is a sample

Thank You
Thomasius1

• This reply was modified 3 years, 4 months ago by thomasius1.

Hi @thomasius1, thanks for providing that extra information.

I have been on annual leave and have been catching up on responses that may have been missed in the mean time as WordPress forums don’t return all new topics to the top for attention.

The most common cause for Wordfence blocking logins when the login URL has been changed is that xmlrpc.php still exists, and attackers try logging in there. If your site is not using XML-RPC for the WordPress app or for other plugins such as Jetpack, you can select Wordfence > All Options > Disable XML-RPC Authentication to disable logins through this method.

Thanks again,

Peter.

Hi Peter,
thanks for your answer, I try this.!

Hi @thomasius1,

No worries at all, please also note that XML-RPC can be disabled altogether if you’re not using a plugin such as Jetpack or the WordPress mobile app by inserting the following code into your .htaccess file:

# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>

If you notice any plugins or features negatively impacted by this, you can simply remove it again.

Thanks,

Peter.