How to ban IP from a country

I forgot to ask . . .

#4. If I set up the Cookie Based Brutal Attack Prevention, will I be able to use another browser or commuter to log in?

They have all the usernames !!! Now it came from Netherlands. How did they get them ???

I know I asked a lot of questions, but thank you for your patience with a non-geek : )

We don’t currently have a “block by country” feature but we will introduce something in a future update.

I recommend you use one of the following to protect your site’s login page:

1) Brute Force Prevention feature.
Yes you can use this from any browser or computer. You just need to remember your secret word.
Please see this for more info:
https://www.tipsandtricks-hq.com/all-in-one-wp-security-plugin-cookie-based-brute-force-login-attack-prevention-feature-5994

2) Whitelist feature
This will only allow the IP addresses you have specified in the settings to access your admin page.
(Just remember that if your IP changes you will need to enter the new address in the whitelist settings.
If you get locked out it’s no big deal because as long as you have FTP access it is easy to rectify this.)

Thank you for the quick reply.

Yes. I will set up the Brute Force Prevention. Thank you for the link. I will read it. But, not so sure about the whitelist because I use VPN all the time. I am really not comfortable using FTP yet. I have it, but not too savvy with it. Can I get around it?

I have changed the time-out setting to 2 X in 1 min. They are shooting at me like automatic! 4 attempts in 1 min. It hurts to be popular : (

Also, how can they get the usernames? Has my blog been already breached?

Thanks!

Oh . . also, what if I purge the cookies??? The instruction page did not address that. I have to type in or copy the secret URL?

what if I purge the cookies?

It doesn’t matter because as long as you use the secret word in the URL, the plugin will take care of the cookie automatically by renewing it. (see the link I sent you for more info about the cookie based brute force feature)

how can they get the usernames? Has my blog been already breached?

Without looking at your site setup and situation it is difficult to guess at exactly how they would’ve retrieved the usernames or what access they have.

Another suggestion is that you change your account usernames so that the old ones become invalid.

After that, when you apply one of the suggestions I gave you in my last reply you should be a lot more secure.

Thank you.

Is it possible for you to look at my site and investigate?

olivetjournal.com

I will follow your suggestions, but will need to contact all my registrants by e-mail asking them to change their use names. I cannot keep doing that.

If I need to hire you for a fee, I am willing to do it. When you find out a weak point, you may be able to integrate a solution into the plug-in, so will help others also.

OK . . .

I did it. I had the Brute Force Prevention measure installed, and got the new URL. But, I am not sure if I did it right.

I put the new URL in the address box and hit [Enter], but it goes to the original Log-In URL and, my browser fills in the UN and PW as it has been programmed to do so.

Is it the way it is supposed to be?

– – – – – – – – – – – – – – – – – – – – – – –

p.s.: I found an interesting blog article on Brute Force Attack on WP HERE that discusses “backdoor.”

I put the new URL in the address box and hit [Enter], but it goes to the original Log-In URL……Is it the way it is supposed to be?

Yes – congratulations you are a now successfully using the Brute Force prevention feature.

Regarding the username/password automatically being filled in – your browser is doing that so for your situation that’s normal.

Well . . . It seems to be working fine. And I have not had any e-mail attack notice for 24 hours.

Thank you for you assistance!

Regarding the usernames that were leaked, it is not from my admin site, since no one has broken in. So, I posted a note in the WP support so the team may pick it up and look in to it. They might know how to get them from WP registration system.

Blessings!