gcranston

Can I second that? Came looking for this specifically ?? Great plugin, thanks.

Thanks for fixing that so quickly, was getting worried about what I might have done!

Further to the information above, I have a little more information that’s really raising my doubts about this plugin… please correct my assumptions if I am wrong though.

Last night, over a 59 minute period, a single IP address made 10,004 POST requests to wp-login.php. I have this information from filtering the webserver’s raw log data.

I did this because my website was brought down for about an hour coinciding with this attack. Resource usage (on shared hosting) was maxed out, so nothing could be accessed by anyone. There were too many concurrently running processes to allow anything else to happen.

Why are so many processes being used? Is it simply because of the attack? It would seem to me as though a plugin like this would be expected to solve that problem, but I’m wondering if its actually creating a problem having processes running delaying things? If not, why did my site come down for an hour? Wouldn’t it just be solved by having a lockout on attempts from one place?

Out of interest, why is it insecure? Wouldn’t it just be showing attempted password guesses? It seems almost interesting more than anything, what sort of passwords these attacks try!

Solved my own query. I get it now… it does look like you can log in still, but as soon as you try to do anything useful it chucks you off. Good work!

That’s useful information, thanks. Good to know where we stand. Good luck with future progress!