BruteForce Attacks in WP Login during Away-Mode

  • Hi,

    I had ithemes installed on my pages since 2016, but lately get a lof of BruteForce Attacks DURING AWAY MODE.

    As I thought maybe something went wrong with an update or so, I deactivated, deleted and reinstalled and activated that plugin on one of my websites – as it looks to no avail.

    But still the BruteForce Attack get access to the Log in Area. As I am unable to reach it when the site is in away mode, I wonder how the bruteforce attacks get through.

    On neither page can anyone create an account, nor are there any logins or links to the login area on the page (as often found in the widget-area from blogs).

    For one page I have even reduced the “open” time to 30 minutes of a day.

    ALSO: I seem to remember that in 2016/2017 when I was logged in before away-mode set in, I wasn’t kicked out. Now I am. Really dislike that. What is the reasoning behind that?

Viewing 5 replies - 1 through 5 (of 5 total)

  • I hace the same problem.

    Also in away mode receive blocks from admin attemp login.

    Hope someone can help us

    @northernannie
    According to the 7.0.2 Changelog:

    Bug Fix: Away Mode would not lock out users who were already logged-in during the “away” period.

    7.0.2 was released on June 14th 2018.

    Also the Away Mode module is only for preventing access to the WordPress Dashboard login page. It does not prevent all types of brute force attack.

    To prevent any confusion, I’m not iThemes.

    Thread Starter northernannie

    (@northernannie)

    @nlpro

    ha, who would’ve thought that it was a bug to not be logged out…. i really liked it as I tend to not have fixed hours when I work – which is a nightmare with away-mode kicking me out.

    Just so I understand the login-thing you are saying: Even if there is no “open” access to any log-in area, they still can reach a point where they can try to log in?

    (edit) Thank you for your help.

    • This reply was modified 5 years, 11 months ago by northernannie.

    @mmoore247
    Perhaps an extra setting for the Away Mode module that allows you to enable/disable being logged out during away hours would be nice…

    @northernannie
    Anyway Away Mode falls in the category security by obscurity. It doesn’t really strengthen the security of your site.
    At most it will only slow down attackers …

    WordPress includes several APIs that provide endpoints to authenticate (XML-RPC, REST API etc). So restricting access to the login page won’t stop all brute force attacks.

    • This reply was modified 5 years, 11 months ago by nlpro.
    • This reply was modified 5 years, 11 months ago by nlpro.
    • This reply was modified 5 years, 11 months ago by nlpro.
    Thread Starter northernannie

    (@northernannie)

    @nlpro Oh, I didn’t know that – but then again I am not a web designer or coder (obvi lol) Again, thank you for your help here.

    Oh yes, the option to enable/disable log out would be awesome – and if it poses a big risk it could be limited to admin users ?? (which probably would make the whole idea even more complicated.

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘BruteForce Attacks in WP Login during Away-Mode’ is closed to new replies.