Robert Peake

Great, glad that was useful, and thanks for pointing this out as it made the plugin better! ??

I see the confusion here. Bots (like legitimate users) will still be able to access the /wp-login.php URL, and will still show up in your log files as doing so. None of their attempts at brute-force login should actually be abel to succeed now, though, because they can’t fulfil the reCaptcha requirement and so all of their brute-force attempts will fail.

That is what this plugin is designed to do–prevent bots from making a successful login via brute-force, not prevent them from trying the brute-force in the first place. Based on my testing, it is working and doing that now, which is keeping your sites secure.

If you want to stop bots completely from accessing /wp-login.php and making brute-force attempts in the first place, you can use something like the Limit Login Attempts plugin to blacklist them by IP after too many attempts. I use this myself as part of a “defence in depth” strategy, which is a good idea in general for security.

I hope this helps.

Could you explain your methods so that I might reproduce them?

Here is how I am testing:

1) reset a browser completely, enable javascript, enter correct login/password and check reCaptcha box — login succeeds

2) reset a browser completely, disable javascript, enter correct login/password but do not enter reCaptcha — login fails

Based on this simple test, it would appear that the implementation Google recommends for non-javascript login forms does indeed block the login when javascript is disabled (#2).

Excellent, thanks! I have to admit Google’s non-js implementation of captcha is really not user-friendly, but at least this stops the bots. If you’d like to contribute pull requests or patches for other captcha options offered by Google I’d welcome that. Let me know if so, and I’ll set this up on GitHub.

I use it myself!

Glad you found it useful!

Tom, I think I see the issue now–in SVN I am robertpeake but on the www.remarpro.com website I am robert.peake. Try that. Very confusing!

Can you be more specific? This is running in production on multiple websites and working fine on all of them. Perhaps we can help…

Thanks very much for pointing this out. The next release (1.1) contains this important security improvement.

Hi Purpletriangle,

What are you seeing that doesn’t look right? When I try it on my iPhone, the reCaptcha scales down just like the username/password boxes and fits nicely on the screen. I can tap it to check it, and it all works just fine. Can you tell me more about what you are seeing that doesn’t appear to be responsive?

Here is what I see: https://imgur.com/M9cfy5p

Best,
Robert

Hi highsagan,

I have modified Better Random Redirect to work with qTranslate-X. Now urls like: https://www.site.com/lang_iso/random/ should work for that particular language. These features are available since version 1.3.3, so you will need to upgrade.

I hope this helps!

Best wishes,
Robert

Hi highsagan,

For some reason www.remarpro.com didn’t notify me about your post, so I am just seeing this now. Give me a little time to install qtranslateX on my development environment and see if there might be a convenient solution for you here. More soon.

Best wishes,
Robert

Great, thanks!