wp-admin locked down through htaccess, but still getting TONS of login attempts

The Limit Login Attempts plugin does well to stop these malicious bots. Note: While it has not been updated as noted at the link, I have it working fine on both single and multi-site installations at WP4.0. See also:

http://codex.wordpress.org/Brute_Force_Attacks

Your best course of action is a strong and unique password for the site admin user(s). I strongly suggest also not using admin as a USERNAME but create a password like one.

To understand why the password should not just be a strong one but also be unique see:

http://en.blog.wordpress.com/2014/09/12/gmail-password-leak-update/

See, people tend to use the same password for varying sites/logins. Once one is compromised and the credentials stolen, these malicious bots go to work attempting to login to all the popular sites, and gosh, even banking sites..their goal is theft and often they succeed when folks use poor security measures!

The single most powerful tool is both a unique and password like USERNAME and a unique and strong password.

@daisy101

You need to log into your cPanel account and edit the .htaccess file and erase the code you entered.

After that, add the following lines:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} .(wp-comments-post|wp-login|wp-admin)\.php*
RewriteCond %{HTTP_REFERER} !.*YOUR-DOMAIN.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule (.*) ^http://%{REMOTE_ADDR}/$ [R=301,L]
</IfModule>

This will help you.

Good luck!

Please post a few lines of your Apache logs.

No, don’t copy this htaccess to wp-admin folder. Those rules from the root htaccess should affect all files and folders.

Try this:

Options -Indexes
ServerSignature Off
Options +FollowSymlinks

# Protect BEGIN

<Files .htaccess,.svn>
order allow,deny
deny from all
</Files>

<Files ~ "^.*\.([Hh][Tt][Aa])">
    order allow,deny
    deny from all
    satisfy all
</Files>

# protect wp-config.php START
<files wp-config.php>
order deny,allow
deny from all
</files>
# protect wp-config.php END

# Bad bots
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_USER_AGENT} libwww-perl.*
RewriteRule .* – [F,L]
# Bad bots

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} .(wp-comments-post|wp-login|wp-admin)\.php*
RewriteCond %{HTTP_REFERER} !.*thelinuxterminal.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule (.*) ^http://%{REMOTE_ADDR}/$ [R=301,L]
</IfModule>

# Protect END

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

I have the same problem as the OP. I already had the Limit Login Attempts plugin and that mailed me about more and more (temporarily) blocked IP’s because of brute force attacks.

So I used .htaccss to block all IP’s but mine to the /wp-admin directory.
Also, I renamed the /wp-login.php to prevent login attempts.
Also, the ‘register’ option is off
And all pages and posts are one by one checked to see if the ‘react to this’ option is off.

Still I get mails from the Limit Login Attempts plugin that IP’s are blocked because of multiple failed login attempts. How is this even possible?