Increases in Login Attempts after WordFence Install

Hi,

Many attacks are coordinated using a “botnet”, so when a large attack occurs from many different IPs in different countries, it can run for a long time. It can seem somewhat random — if an attacker with a large botnet hasn’t found each of your sites yet, you might only get a few scattered attempts. On sites that get a lot of attacks, they’ll usually stop after a while. Some last for a few days, and some can last for months.

We certainly don’t attack sites ourselves.

We have an article in our learning center about who attacks sites and what they’re trying to accomplish, if you’re interested:
How to Protect Yourself from WordPress Security Issues & Threats

-Matt R

Matt,

Thank you for the reply. Glad that WordFence isn’t part of the attacks… My site is no longer getting attacked, and so it may have been a coordniated botnet as you suggest. I wonder why this happened as soon as I installed WordFence, and it did not occur on any other of my sites. I’m suspicious that this is coincidence, as it has happened to others as well…. Any insight from WordFence on why/how this is happening?

I am satisfied with WordFence as of these past weeks, and so I hope it continues to be a good protection.

Matt, Do you by chance know how to clear all the old “Live Traffic” Log? I posted on it here, but the suggested solution was inadequate.

Hi,

I don’t think the new attacks are related to installing Wordfence. This really doesn’t come up often even though the plugin is installed on over a million sites, and the last case I remember where someone asked about it, the user didn’t actually have a way to monitor attacks before installing the plugin. (They didn’t know about Apache’s access logs and had no other plugin to monitor failed logins.)

For the other question, we don’t have an option to clear the hits, but on the options page, you can adjust “Amount of Live Traffic data to store (number of rows)” to a low number — it won’t always clear immediately, but clearing is scheduled. We do have a feature request open, to possibly implement this in the future (reference number FB570), so I’ve added your input there. Thanks!

-Matt R

Hi,

Further to this topic, without installing wf we really wouldnt know about the attacks but post install we get to know the IP details etc, so need to understand how the attackers to know the targets with wordpress installed is there any method to that coz i have noticed that when site runs in demo mode usually with subdomain like test.domain.com or xyz.domain.com there are no such attacks but moment site is live like domain.com or xyz.com attacks from various parts of the world try to take over.

Thanks