Brute force attack without wp-login.php file
-
Hello there, we have a site under brute-force attack since ten/fifteen days.
The site is fully updated and we installed Simple Security Firewall (https://wordpress.org/plugins/wp-simple-firewall/) and Sucuri Security (https://wordpress.org/plugins/sucuri-scanner/).
The login form should be protected by captcha and G.A.S.P. protection.
The permissions settings are strict (750 and 640).
Even when I delete the wp-login.php file the attack continues. How is this possible? Are they able to try to login thru a backdoor?
What can I do to further protect the site?
Here you have a notification of a login attempt:
Subject: Failed Login
Login Info:
Time: July 21, 2015 7:00 am
Website Info:
Site: http://XXXXX.XXX
IP Address: 173.245.53.154
Notification:
User authentication failed: test
User wrong password:If you need more info just ask, thanks!
The topic ‘Brute force attack without wp-login.php file’ is closed to new replies.