I was getting WordPress notifications like this:
“For your security, your account has been locked because of too many failed login attempts. To unlock your account please click the following link:
https://mysitename.org/login/?action=unlock&key=qwV*****9y2uk&login=admin
The following attempts resulted in the lock:
180.191.127.157 2017/06/17 12:42:23 PM
180.191.127.157 2017/06/17 12:42:25 PM
36.227.112.160 2017/06/17 1:06:50 PM
36.227.112.160 2017/06/17 1:06:52 PM
182.253.163.30 2017/06/17 1:22:56 PM”
(Those IPs are Philippines, Taiwan and Indonesia, only AU and GR are white-listed). I have a backup administrator account of course. Most of the attempts are on the admin account, but I have had attempts on other accounts. I’ll look at it again tomorrow – it’s late here.
Thanks for your patience.