Title: Brute force attacks
Last modified: August 21, 2016

---

# Brute force attacks

 *  [3pepe3](https://wordpress.org/support/users/3pepe3/)
 * (@3pepe3)
 * [12 years, 2 months ago](https://wordpress.org/support/topic/brute-force-attacks-7/)
 * Hello,
 * I have a site that is running on Debian 7.
 * Today fail2ban banned more than 500 IPs.
    A few minutes ago my load average was
   in the sky.
 * In the site I use WordFence so I block all the IPs that uses the login or lost
   password features more than 2 times.
 * But today I got more than 10 login attempts per second whit rotation of of IPs(
   I don’t know how many computers they have but this is insane).
 * Si thought…. I will add a “die;” at the beginning of the wp-login.php …. but 
   the attempts where still there.
 * A few minutes ago I got a DDoS and rebooting server or restarting the services
   they where still there.
 * Now I added à die in xmlrpc.php I will restart mysql et apache2 to see I this
   can solve my problem… but is there any way to prevent of fix this ???
 * Any ideas ?

Viewing 10 replies - 1 through 10 (of 10 total)

 *  Thread Starter [3pepe3](https://wordpress.org/support/users/3pepe3/)
 * (@3pepe3)
 * [12 years, 2 months ago](https://wordpress.org/support/topic/brute-force-attacks-7/#post-5158367)
 * Actually reading all my logs I have hundred of connections per second.
 *  [supamerz](https://wordpress.org/support/users/supamerz/)
 * (@supamerz)
 * [12 years, 2 months ago](https://wordpress.org/support/topic/brute-force-attacks-7/#post-5158413)
 * Hey,
 * I’ve been getting hacked by some guy as well for the past few weeks. It’s been
   exhausting, to be honest.
 * Earlier the file system got hacked and they were utilizing a ton of bandwidth.
   Upon deletion of those directories, the “bots” kept pinging the non-existing 
   files, causing a bunch of 404s.
    I fixed this by adding a redirect to all of 
   the highly affected directories/files. The redirect was to 127.0.0.1 — so instead
   of having 40,000+ instances of 404’s it just redirects.
 * I also have had the issue of the xmlrpc.php getting pinged, NON-Stop. I disallowed
   access to this file which caused a 403, which in turn, I know that other wordpress
   websites wont be able to send pings/tracks back to mine.
 * I’m still trying to figure out how the hacker is getting into my wordpress site.
   I’ve got BulletProof, Sucuri, Wordfence, all working together to minimize the
   risk and track logins.
 * In your case, I would install Wordfence, and under settings tell it to immediately
   ban IP when trying to login with a non-existing username. Also, tell it to block
   ip if they try more than 3 times etc. Make sure to delete the “admin” user account
   and add the “admin” user account as another way for them to get banned.
 * Hope any of this helps. I’m still struggling myself.
 *  [supamerz](https://wordpress.org/support/users/supamerz/)
 * (@supamerz)
 * [12 years, 2 months ago](https://wordpress.org/support/topic/brute-force-attacks-7/#post-5158414)
 * The reason I did the redirect instead of the 404 is because the 404 is utilizing
   more bandwidth as it pings the database upon each attempt. So instead of using
   700mb of bandwidth it’s down to under 10mb 🙂
 *  [bannorb](https://wordpress.org/support/users/bannorb/)
 * (@bannorb)
 * [12 years, 2 months ago](https://wordpress.org/support/topic/brute-force-attacks-7/#post-5158415)
 * After you ban the ips, do you go to the banned ip (I think that’s what it’s called)
   and permanently ban them? You can also ban networks. Here’s a post from the Wordfence
   site:
 * [http://www.wordfence.com/blog/2013/08/got-a-persistent-scraper-heres-how-to-deal-with-them-permanently/](http://www.wordfence.com/blog/2013/08/got-a-persistent-scraper-heres-how-to-deal-with-them-permanently/)
 * I hope this helps.
 *  [supamerz](https://wordpress.org/support/users/supamerz/)
 * (@supamerz)
 * [12 years, 2 months ago](https://wordpress.org/support/topic/brute-force-attacks-7/#post-5158423)
 * Here is what mine looks like
    [WordFence Settings – Block Login](http://imgur.com/hYTH2W0)
 *  Thread Starter [3pepe3](https://wordpress.org/support/users/3pepe3/)
 * (@3pepe3)
 * [12 years, 2 months ago](https://wordpress.org/support/topic/brute-force-attacks-7/#post-5158426)
 * Thanks… I never use an admin account.
    Also I disable the archive for authors.
   and all my user accounts are e-mails.
 * Use e-mail prevents showing the real admin account name in archives, blog authors,
   etc.
 * Ex. [me@pepe.com](https://wordpress.org/support/topic/brute-force-attacks-7/me@pepe.com?output_format=md)
   will result on mepepe.com
    and for all my passwords I use something very simple.
   Ex. [http://www.this-is-my-super-site.com](http://www.this-is-my-super-site.com)
   so password would be: +H1$1$m1svp3r$1t3
 * Well, tomorrow I will test this :
    `add_filter( 'xmlrpc_enabled', '__return_false');`
 * I feel that server will be down this night :'(
 * Also tomorrow I will try to figure out if fail2ban can handle this.
 *  Thread Starter [3pepe3](https://wordpress.org/support/users/3pepe3/)
 * (@3pepe3)
 * [12 years, 2 months ago](https://wordpress.org/support/topic/brute-force-attacks-7/#post-5158467)
 * Well…xmlrpc has been disabled with
    `add_filter( 'xmlrpc_enabled', '__return_false');`
 * but now let’s see if there is a filter or action to prevent the recovery password
   and logging attempts using wp-login.php
 * maybe the straight forward solution would be in the .htaccess
 *  [supamerz](https://wordpress.org/support/users/supamerz/)
 * (@supamerz)
 * [12 years, 2 months ago](https://wordpress.org/support/topic/brute-force-attacks-7/#post-5158525)
 * Keep me updated, I’d love to know if you get any resolution.
 * I checked my logs and my xmlrpc.php is no longer being attacked, after an entire
   days worth of 403 denied requests.
 * As far as my hacked site goes, I’m going to look through infected plugins and
   hopefully find the issue.
 *  Thread Starter [3pepe3](https://wordpress.org/support/users/3pepe3/)
 * (@3pepe3)
 * [12 years, 2 months ago](https://wordpress.org/support/topic/brute-force-attacks-7/#post-5158543)
 * In fail2ban I implemented the next feature :
    [http://wiki.linuxservertech.com/index.php?action=artikel&cat=26&id=201&artlang=en](http://wiki.linuxservertech.com/index.php?action=artikel&cat=26&id=201&artlang=en)
   This is a nice option because on the same server I have several sites and with
   this I can be sure that this kind of attacks will be blocked (this will work 
   only if they try 2 times… and yesterday was not the case, it was a different 
   IP each time).
 * And maybe I will set this approach too, but it means that I will need to send
   an email to each client and I will take the risk that something crashes:
    [http://www.frameloss.org/2013/04/26/even-easier-brute-force-login-protection-for-wordpress/](http://www.frameloss.org/2013/04/26/even-easier-brute-force-login-protection-for-wordpress/)
 * There are some points that bother me with the wp-login.php file…
 *     ```
       case 'lostpassword' :
       case 'retrievepassword' :
       ```
   
 * Why we cant trigger an action ?
 * Also since a few projects I always change the file structure :
 * wp-config.php
 *     ```
       $protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || $_SERVER['SERVER_PORT'] == 443)? "https://" : "http://";
       $server_name = $_SERVER['SERVER_NAME'];
       $doc_root =  $_SERVER['DOCUMENT_ROOT'] ;
   
       define('WP_SITEURL', $protocol . $_SERVER['SERVER_NAME']);
   
       define('WP_CONTENT_DIR', $doc_root . '/content' );
       define('WP_CONTENT_URL', $protocol . $server_name . '/content');
   
        define('WP_PLUGIN_DIR', $doc_root . '/plugins' );
        define('WP_PLUGIN_URL', $protocol. $server_name .'/plugins');
       ```
   
 * Now I need to figure out how can we prevent the attempts from login on sites 
   where xmlrcp is enabled.
 * Also prevent all the “Lost Password” attempts.
 * :'( too much work
 *  Thread Starter [3pepe3](https://wordpress.org/support/users/3pepe3/)
 * (@3pepe3)
 * [11 years, 11 months ago](https://wordpress.org/support/topic/brute-force-attacks-7/#post-5158727)
 * Once again, in the last days, I was forced to disable xmlrpc on 3 different sites.
   
   Wordfence detected and locked all the incoming IPs after 2 login failures. Wordfence
   was locking almost 10 IPs per second (and my email account was getting full due
   the wordfence alerts).

Viewing 10 replies - 1 through 10 (of 10 total)

 The topic ‘Brute force attacks’ is closed to new replies.

## Tags

 * [XML-RPC](https://wordpress.org/support/topic-tag/xml-rpc/)

 * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
 * 10 replies
 * 3 participants
 * Last reply from: [3pepe3](https://wordpress.org/support/users/3pepe3/)
 * Last activity: [11 years, 11 months ago](https://wordpress.org/support/topic/brute-force-attacks-7/#post-5158727)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics