Brute Force Login

You can reverse the “Order” directive and use Deny,Allow instead of Allow,Deny and then you would only need to whitelist your Public (ISP) IP address.

# Protect wp-login.php from Brute Force Login Attacks based on IP Address
<FilesMatch "^(wp-login\.php)">
Order Deny,Allow
Allow from 65.100.50.
</FilesMatch>

Most ISP’s change your public IP address very regularly and very frequently. Some ISP’s only change the last octet of the IP address, some change the last 2 octets, some change the last 3 octets and some change all octets. Your options would be to try and use all possible IP addresses that you host uses or choose another way to protect your login page instead of doing this via IP address.

# Protect wp-login.php from Brute Force Login Attacks based on IP Address
<FilesMatch "^(wp-login\.php)">
Order Deny,Allow
Allow from 65.100.50.
Allow from xxx.xxx.
Allow from xxx.xxx
</FilesMatch>

Yes, you have reversed the “Order” directive.

Or you can use both. See this forum topic: http://forum.ait-pro.com/forums/topic/protect-login-page-from-brute-force-login-attacks/

Yes

If you want to add more IP addresses….

# Protect wp-login.php from Brute Force Login Attacks based on Server Protocol or IP
# All legitimate humans and bots should be using Server Protocol HTTP/1.1
RewriteCond %{REQUEST_URI} ^/wp-login\.php$
RewriteCond %{THE_REQUEST} HTTP/1\.0 [OR]
RewriteCond %{REMOTE_ADDR} !^(xxx\.xxx\.xxx\.|xxx\.xxx\.|xxx\.xxx\.)$
RewriteRule ^(.*)$ - [F]

Or you could contact your host and ask them to upgrade their Proxy software to Server Protocol HTTP/1.1 which is the new Server Protocol as of 1999 – 15 years ago.

What I have seen that is fairly common is a host offers both HTTP/1.0 and HTTP/1.1 and defaults to HTTP/1.0 usage. Why that would be I do not know. So it may already be available to you, but you were just not aware of that.

Different things. Apache is the server type/software. HTTP/1.0 or HTTP/1.1 is the Server Protocol that would be configured in a server config file.

Example: Nginx Reverse Proxy would have this type of configuration setting in the proxy.conf configuration file where you could set the protocol to 1.0 or 1.1. Squid Proxy and other Proxy software are generally similar – it is a configuration setting, but the Proxy software version must be updated to a version that can use Server Protocol HTTP/1.1 in order to configure the Proxy software to use it.

# Defines if reverse-proxying should use HTTP 1.0 or 1.1
# You should try which gives you better results,
# or if you find any significant differences at all
proxy_http_version		1.0;

No that code is no good. It would affect your entire site and not just your Login page. There is no Login page condition in that basic crude example.