Renames but, there is still a back door.

Well that explains my problem as well.
Did the rename
Removed wp-login.php
locked down /wp-admin
Yet the attempts continue….and actually got worse.

So, then I put in a redirect to wp-register.php

We’ll see what happens.

login attempts continue <sigh>

2 things to strengthen your sites, use google auth plugin along with this disable xml-rpc

And I do believe that hiding wp-register.php should also implemented within Rename Wp-login.php. Disabling XML-RPC will probably fix your situation instantly. I recommend using both at the same time.

I’ve got the same thing happening on a client site. After installing rename-wp-login plug-in, attempts by hackers subsided for about a month. Then, the attempts started up again.

After reading this thread, I used the url with /wp-register.php and the registration page appeared (even though I also have registration disabled). I was able to log-in on that page. VERY DISCONCERTING!

How can we hide the wp-register.php page?

I’m fine with using the Google authenticator, but not sure if my client would be able to use it. They might not have a smart phone…

I set a redirect for wp-register.php (as I have it also disabled) to another page or just the home page.
Then I had to rename the wp-login again as it was known using the wp-register.php and so far, not more attempts.

Thanks creativewebdesigns03. I’ve implemented the redirect and will use a new login location. We’ll see if the login attempts subside.

This plug-in should really protect against this. I might research other options in the meantime…

Unfortunately, the login attempts are still coming in? <sigh>

I have redirected wp-register.php
wp-login.php has been renamed and the actual file wp-login.php has been removed.

I have restricted access to .wp-admin to specific IPs so /wp-admin is not available

I have NO idea how the login attempts continue? Any other backdoor to wp-login

I’m in the same boat creativewebdesigns03. I’ve done everything you’ve done, login attempts subsided for a few days, then started up again.

Next thing I did was install WP Google Authenticator plug-in. Again, login attempts subsided for a few days, then started up again today.

Now I’m going to ban certain IPs. …And then find myself another renaming plug-in. This one definitely has vulnerabilities.

Yep, it’s vulnerable. Got two single hack attempts in the first 6 hours. But it’s only been about 8 hours, and I’m expecting the bots to hit again by the end of the day. The day before installing, I had about 2,000 hack attempts.

Are you disabling xmlrpc? If you’re not, this is normal…

Is that directed at me, or the other people before me? Since I have no idea what that is, or where to disable it, I will say no. :-).

By the way, I’ve had the plug-in installed almost a week. I will get an occasional single hack attempt. Maybe 8 or 10? The last one was 3 days from the prior one. Certainly the bots haven’t come back.

xmlrpc is an api through which you can log in as well. It’s used for the mobile apps etc. If you don’t use external apps, you can turn it off (you can add a filter or use a plugin). Login attempts made through xmlrpc will be counted by the plugin you use.

In other words xmlrpc is probably the backdoor you’re looking for.

Twenty days into testing and only one attempted “admin” access from a rogue VPN user today. Not a problem … yet.
I’ve temporarily disabled xmlrpc until I can examine a workaround for using certain mobile devices, but the larger issue on previous posts re: “…register.php” still remains. Is there nothing that can be done to fix this open-door invitation to all?
Seriously… if we are reading about the discovered problem, what do you think the other side is doing?

I just got email notification of Starman’s post, reminded me about this thread! I’ve only had 8 or 10 hack attempts since renaming wp-login.php, and they were all in the first day or two or three! My activity log plug in of choice (forgot what it’s even called) tells me the last one was at least 2 weeks ago. As I said previously, I had a couple thousand hack attempts the day before installing. I will do this xmlprc thing though, thanks.