Ubet63 link philippines,Ez jili casino login philippines.Recharge Every day and Get Bonus up-to 50%!

Resolved Cecilia Svensson
(@ceciliasvensson)

6 years, 12 months ago

Hi!
I need some help figuring out my settings for blocking users. I’ve searched the forum and read the documentation, and clearly, there is something I don’t get here.

Here are some of my settings:

1. I have listed several tried-to-hack-my-site-usernames in the section
“Immediately block the IP of users who try to sign in as these usernames”.
One per row.

2. I have set the “Lock out after how many login failures” to 1 (yes, one).

3. “Lock out after how many forgot passwords attempts” is also set to 1.

4. “Count failures over what time period” = 1 day

5. “Amount of time a user is locked out” = 1 day

6. Immediately lock out invalid usernames = yes

This leads me to believe that there can be no more than one false login attempt per day, per false username and IP-address.

My log looks like this, except for the fact that I have masked the real data. The username and IP-addresses are identical for all rows.

My questions are:
a) How come they can try repeatedly with the same username?
b) How come they can try repeatedly with the same IP-address?

Username – IP-address – Time sine login attempt 
****** – 115.xxx.yy.zz – 5 hours 36 mins ago 
****** – 115.xxx.yy.zz – 5 hours 36 mins ago 
****** – 115.xxx.yy.zz – 5 hours 36 mins ago 
****** – 115.xxx.yy.zz – 5 hours 36 mins ago 
****** – 115.xxx.yy.zz – 5 hours 37 mins ago 
****** – 115.xxx.yy.zz – 5 hours 37 mins ago 
****** – 115.xxx.yy.zz – 5 hours 37 mins ago 
****** – 115.xxx.yy.zz – 5 hours 37 mins ago 
****** – 115.xxx.yy.zz – 5 hours 37 mins ago 
****** – 115.xxx.yy.zz – 5 hours 37 mins ago 
****** – 115.xxx.yy.zz – 5 hours 37 mins ago 
****** – 115.xxx.yy.zz – 5 hours 37 mins ago 
****** – 115.xxx.yy.zz – 5 hours 37 mins ago 
****** – 115.xxx.yy.zz – 5 hours 37 mins ago 
****** – 115.xxx.yy.zz – 5 hours 37 mins ago 
****** – 115.xxx.yy.zz – 5 hours 37 mins ago 
****** – 115.xxx.yy.zz – 5 hours 38 mins ago 
****** – 115.xxx.yy.zz – 5 hours 38 mins ago 
****** – 115.xxx.yy.zz – 5 hours 38 mins ago 
****** – 115.xxx.yy.zz – 5 hours 38 mins ago 
****** – 115.xxx.yy.zz – 5 hours 38 mins ago 
****** – 115.xxx.yy.zz – 5 hours 38 mins ago 
****** – 115.xxx.yy.zz – 5 hours 38 mins ago 
****** – 115.xxx.yy.zz – 5 hours 38 mins ago 
****** – 115.xxx.yy.zz – 5 hours 38 mins ago 
****** – 115.xxx.yy.zz – 5 hours 38 mins ago 
****** – 115.xxx.yy.zz – 5 hours 38 mins ago 
****** – 115.xxx.yy.zz – 5 hours 38 mins ago 
****** – 115.xxx.yy.zz – 5 hours 38 mins ago 
****** – 115.xxx.yy.zz – 5 hours 38 mins ago 
****** – 115.xxx.yy.zz – 5 hours 38 mins ago 
****** – 115.xxx.yy.zz – 5 hours 39 mins ago 
****** – 115.xxx.yy.zz – 5 hours 39 mins ago 
****** – 115.xxx.yy.zz – 5 hours 39 mins ago 
****** – 115.xxx.yy.zz – 5 hours 39 mins ago 
****** – 115.xxx.yy.zz – 5 hours 39 mins ago 
****** – 115.xxx.yy.zz – 5 hours 39 mins ago 
****** – 115.xxx.yy.zz – 5 hours 39 mins ago 
****** – 115.xxx.yy.zz – 5 hours 39 mins ago 
****** – 115.xxx.yy.zz – 5 hours 39 mins ago 
****** – 115.xxx.yy.zz – 5 hours 39 mins ago 
****** – 115.xxx.yy.zz – 5 hours 39 mins ago 
****** – 115.xxx.yy.zz – 5 hours 39 mins ago 
****** – 115.xxx.yy.zz – 5 hours 39 mins ago 
****** – 115.xxx.yy.zz – 5 hours 39 mins ago 
****** – 115.xxx.yy.zz – 5 hours 39 mins ago 
****** – 115.xxx.yy.zz – 5 hours 39 mins ago 
****** – 115.xxx.yy.zz – 5 hours 39 mins ago 
****** – 115.xxx.yy.zz – 5 hours 39 mins ago 
****** – 115.xxx.yy.zz – 5 hours 40 mins ago 
****** – 115.xxx.yy.zz – 5 hours 40 mins ago 
****** – 115.xxx.yy.zz – 5 hours 40 mins ago 
****** – 115.xxx.yy.zz – 5 hours 40 mins ago 
****** – 115.xxx.yy.zz – 5 hours 40 mins ago 
****** – 115.xxx.yy.zz – 5 hours 40 mins ago 
****** – 115.xxx.yy.zz – 5 hours 40 mins ago 
****** – 115.xxx.yy.zz – 5 hours 40 mins ago 
****** – 115.xxx.yy.zz – 5 hours 40 mins ago 
****** – 115.xxx.yy.zz – 5 hours 40 mins ago 
****** – 115.xxx.yy.zz – 5 hours 40 mins ago 
****** – 115.xxx.yy.zz – 5 hours 40 mins ago 
****** – 115.xxx.yy.zz – 5 hours 40 mins ago 
****** – 115.xxx.yy.zz – 5 hours 40 mins ago 
****** – 115.xxx.yy.zz – 5 hours 40 mins ago 
****** – 115.xxx.yy.zz – 5 hours 40 mins ago 
****** – 115.xxx.yy.zz – 5 hours 40 mins ago 
****** – 115.xxx.yy.zz – 5 hours 41 mins ago 
****** – 115.xxx.yy.zz – 5 hours 41 mins ago 
****** – 115.xxx.yy.zz – 5 hours 41 mins ago 
****** – 115.xxx.yy.zz – 5 hours 41 mins ago 
****** – 115.xxx.yy.zz – 5 hours 41 mins ago 
****** – 115.xxx.yy.zz – 5 hours 41 mins ago 
****** – 115.xxx.yy.zz – 5 hours 41 mins ago 
****** – 115.xxx.yy.zz – 5 hours 41 mins ago 
****** – 115.xxx.yy.zz – 5 hours 41 mins ago 
****** – 115.xxx.yy.zz – 5 hours 41 mins ago 
****** – 115.xxx.yy.zz – 5 hours 41 mins ago 
****** – 115.xxx.yy.zz – 5 hours 41 mins ago 
****** – 115.xxx.yy.zz – 5 hours 41 mins ago 
****** – 115.xxx.yy.zz – 5 hours 41 mins ago 
****** – 115.xxx.yy.zz – 5 hours 41 mins ago 
****** – 115.xxx.yy.zz – 5 hours 41 mins ago 
****** – 115.xxx.yy.zz – 5 hours 41 mins ago 
****** – 115.xxx.yy.zz – 5 hours 41 mins ago 
****** – 115.xxx.yy.zz – 5 hours 42 mins ago 
****** – 115.xxx.yy.zz – 5 hours 42 mins ago 
****** – 115.xxx.yy.zz – 5 hours 42 mins ago 
****** – 115.xxx.yy.zz – 5 hours 42 mins ago 
****** – 115.xxx.yy.zz – 5 hours 42 mins ago 
****** – 115.xxx.yy.zz – 5 hours 42 mins ago 
****** – 115.xxx.yy.zz – 5 hours 42 mins ago 
****** – 115.xxx.yy.zz – 5 hours 42 mins ago 
****** – 115.xxx.yy.zz – 5 hours 42 mins ago 
****** – 115.xxx.yy.zz – 5 hours 42 mins ago 
****** – 115.xxx.yy.zz – 5 hours 42 mins ago 
****** – 115.xxx.yy.zz – 5 hours 42 mins ago 
****** – 115.xxx.yy.zz – 5 hours 42 mins ago 
****** – 115.xxx.yy.zz – 5 hours 42 mins ago 
****** – 115.xxx.yy.zz – 5 hours 42 mins ago 
****** – 115.xxx.yy.zz – 5 hours 42 mins ago 

The page I need help with: [log in to see the link]

Viewing 15 replies - 1 through 15 (of 17 total)

1 2 →

ozzdogg
(@ozzdogg)

6 years, 11 months ago

I am stumped by the same issue. On my site, there was one IP address that failed to login 1496 times – using a username that I set to *immediately* block – until I manually blocked it. I have my settings to block after only 20 failed logins within an hour.

It appears that the Login Security is not working at all.

I am hopeful someone can explain this for us.
Chris

Thread Starter Cecilia Svensson
(@ceciliasvensson)

6 years, 11 months ago

Thanks for joining me in this Chris! Yes, it would be great if someone could explain this.
I used to have that same setting, one hour. Just trying to find ways to tweak this. Thinking maybe I misunderstood that timing thing. So I was just about to switch back. But it seems it doesn’t matter what we put in there. They don’t get blocked anyway.

/Cecilia

anonymized-14293447
(@anonymized-14293447)

6 years, 11 months ago

I just had a similar problem. My login attempt always set to 1, I have htaccess to hide login page except to my IP, I even have the site under-costruction, yet people can still manage to attempt usernames and today I actually got someone who was able to login with my real username, disabled Wordfence a play around with my backend.

Are you sure Wordfence is still safe?

Thread Starter Cecilia Svensson
(@ceciliasvensson)

6 years, 11 months ago

Oh wow! No, before I read your post I was bit thoughtful. Now I’m not at all sure!

mountainguy2
(@mountainguy2)

6 years, 11 months ago

Isn’t the log you guys are looking at just showing how many blocked login attempts, indicating that Wordfence is doing its job? If I’m not mistaken, when Wordfence blocks a hit, it’s still a hit. If you want to keep those hits out of the Wordfence log they need to be blocked at a “higher” level. For example, using plugin WPS Hide Login will result in a “not found” error and the blocked login attempts will not end up in your Wordfence logs, though they’ll still be occurring as the bots never sleep. MTN

Thread Starter Cecilia Svensson
(@ceciliasvensson)

6 years, 11 months ago

Thanks for joining in, helping out!

Yes, the headline of the log is “Login attempts”. I must have misunderstood the concept of blocking. I interpreted it as this: tat the same IP-address could not try another login attempt for as long as I’ve set the time. And although I know they never sleep I thought it wouldn’t show in a log. I don’t mind that they do, it’s just I’m a bit worried.

anonymized-14293447
(@anonymized-14293447)

6 years, 11 months ago

@mountainguy, I’m completely sure this was a hacker from Serbia. I got an email “A user with username xxx deactivated Wordfence on your WordPress site.” so I went into the site and discovered that WF and my Maintenance plugin were disabled. Moreover, in Admin profile there were all name/address/… fields filled in. There were also some username guesses in the “public name” field probably stored in a cache. How do you explain all this if not a hole in Wordfence?

mountainguy2
(@mountainguy2)

6 years, 11 months ago

You would have to block the IP address at “server level” and even then the attacks would be recorded in server logs. MTN

mountainguy2
(@mountainguy2)

6 years, 11 months ago

Oh! If your site was compromised, sure, there are a million explanations. Sometimes only an expert in computer forensics can figure it out. There is no security software that makes your site 100% protected, the only 100% protection is multiple redundant backups. MTN

wfyann
(@wfyann)

6 years, 11 months ago

Hi,

I don’t think I could address those questions better than @mountainguy2 already has.

———————————————–

@ceciliasvensson,

The log is indeed showing you login attempts; as long as the ones you mentioned are marked as failed, you have nothing to worry about. Wordfence is doing its job.

In case you wish to no longer see attempts from that IP being logged, you’ll need to exclude it either at the .htaccess level or via a firewall at the host/network level.
That said, doing so for each and every suspicious IP could quickly become tedious.

—————————————

@arsenalemusica,

There are several ways a WordPress site could be compromised. More often than not, it is through exploiting a vulnerability in an outdated plugin/theme/core file.
In your case, only an in-depth investigation could tell whether or not Wordfence has missed something.

What I suggest, at this stage, is that you follow the steps described in our site cleaning guide in order to restore your site’s integrity.

—————————————-

@mountainguy2,

Thanks for helping out!

anonymized-14293447
(@anonymized-14293447)

6 years, 11 months ago

Dear @wfyann, I’m not pointing out that my site was hacked (as a matter of fact it wasn’t because probably the hacker was just exercising how to breakthrough)… what I’m pointing out is that the basic settings of Wordfence didn’t work. I mean, how can you break into a site that is offline? And how can you actually discover the Admin username?

mountainguy2
(@mountainguy2)

6 years, 11 months ago

arsenalemusica, if your site was “under construction,” unless you have it walled off in some way from remote access, it can still get hit. As for your site compromise with someone using your credentials, that’s super serious and indicates there is a fundamental flaw of some sort in your security measures. Wordfence has a Site Audit product that might help you, but I’d look first to see if you have a developer employed who may be slacking on the job, or perhaps your web host is a poor choice. Wordfence is an excellent product in mine and thousands of other’s opinion, but it doesn’t defend against everything.

BTW, a good way to wall off a site that’s under construction is to use server configuration to block all IP numbers but your own. Google that up, you’ll find a zillion search results.

MTN
anonymized-14293447
(@anonymized-14293447)

6 years, 11 months ago
but this is what I mean, how can you breach when you got these two in htaccess?
```
# DISABLE THE WHOLE WEBSITE
order deny, allow
deny from all
allow from xx.xx.xx.xx

# HIDE WORDPRESS LOGIN PAGE TO EVERYBODY EXCEPT MY IP
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^xx\.xx\.xx\.xx$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule> 
```
I never had any problems for 3 years and I monitor my site hourly! Now this.
mountainguy2
(@mountainguy2)

6 years, 11 months ago

I don’t know, probably something wrong with your server configuration, or perhaps some kind of internal breach. Again, you’re getting into forensics and might never get a firm answer. As for no problems for years, then ouch, indeed, you never know when a so called “upgrade” of anything from your server software to your plugins is going to introduce a security hole you didn’t have before. To me it appears the situation in that regard gets worse all the time, essentially a nightmare for those of us without an IT security team, and job security if you do happen to be in that field. MTN

Thread Starter Cecilia Svensson
(@ceciliasvensson)

6 years, 11 months ago

Thank you all for helping out, clarifying things.

/Cecilia