hooohn

Problem remains after update…

please help

Basically yes, only this is about the blacklist, not the whitelist feature.

So you recommend to wait for the next bugfix release of the All In One WP Security & Firewall plugin?

… I will thx!

No, that’s the weird thing. It’s not about the “admin” user name but the actual administrator accounts user names which are different from the display names (and not all them publish posts anyway!).

I followed all the rules and configured WP accordingly:

1. tables use different prefix, e.g. “xy_”
2. no administrator account “admin”
3. no user has matching display name and user name, especially not the administrators
   example: 1. Administrator account display name: Fred. User name for Login: Peter

   example: 2. Administrator account display name: Joe. User name for Login: Jimmy

Again, the attacking procedure:

1. they tried to login with “admin” user name and got successfully locked out by the AIO WP S&F plugin
2. After that, all real user names of administrator accounts were known, so they tried with “Peter” and “Jimmy” etc.
3. They still got locked out after 3 times trying to login by the plugin, but somehow overcame the first levels of security.

How could they know all real administrator user names after the first round of lockdown?

Thanks again for looking into this – guidance highly appreciated! 🙂

Hi, thx for the quick reply and sorry for the long pause!

I was busy because I suffered same kind attacks on all my sites plus (!) client sites 🙁

I did not have the pingback feature active, but changed it now and will monitor if new attacks happen.

The procedure of the hacker was as follows:

1. Found out the renamed login address somehow
2. tried to login with “admin” user name -> locked out by the AIO WP S&F plugin
3. After that, ALL REAL ADMIN ACCOUNT NAMES were known and were tried on the login page. No other user names were tried out (did they have access to the database to find out or is there a security glitch with the plugin ???)
4. all login trials lead to lockouts, so there was (hopefully, as far as I can see now) no successful login, though real admin names AND the renamed login address were known

I am a little bit desperate for I must tell clients what’s going on and I have no exact clue…

Any tipps are highly appreciated!!

thx

Hi mbrsolution,

thank you for the quick reply!

I need the double opt-in to confirm/verify the E-Mail address (EU law), the suggested Google-Plugin will not do that, unfortunately.

RPR-Plugin uses the %verification_url% shortcode within the registration E-Mail that already contains the renamed login url in the format:

http://blogname.de/renamed_login_url?action=verifyemail&verification_code=123xyz

So I think they did ok?!

Clicking on the verification link though results in a 404 error when the function in AIOWPS is active.

Thanks again for your help.
Cheers,
Rob