Crazy amount of locked out sign ins on Wordpress

[xecutable]

Has anyone with wordpress and wordfence noticed this? Over the past few months, the amount of bots trying to login with username "admin" "administrator" and anything generic has escalated from like 1-2-3 a day to 1-10 each MINUTE.

My inbox gets over 500 emails a day from locked out bots mostly from Russia or countries around there, occasional US and China bots too.

[Triple7]

Yep, but mainly from France and the US. I'm having quite a strict lock out policy so the numbers are smaller, but the idea is the same.

[wonderpunter]

Yup always..

[-Shay-]

Has anyone with wordpress and wordfence noticed this? Over the past few months, the amount of bots trying to login with username "admin" "administrator" and anything generic has escalated from like 1-2-3 a day to 1-10 each MINUTE.

My inbox gets over 500 emails a day from locked out bots mostly from Russia or countries around there, occasional US and China bots too.

Yes, just had some asshats try for over 28 hours straight

[RacingJim]

Can they try to overrun and slow down your server with these sorts of things, or is it a legit attempt to hack the site? I've had some stuff like this, I guess one way of easily keeping your sites a bit more secure is to not have the 'admin' username as standard. I always choose another username which seems to immediately fend off some crude hacking attempts. With mine it seemed more like an attempt to bring the server down with tons of login attempts.

[GambleThenWin]

Any every wordpress site that I manage (two currently ))). This happens mainly with IP addresses from the US

[-Shay-]

Can they try to overrun and slow down your server with these sorts of things, or is it a legit attempt to hack the site? I've had some stuff like this, I guess one way of easily keeping your sites a bit more secure is to not have the 'admin' username as standard. I always choose another username which seems to immediately fend off some crude hacking attempts. With mine it seemed more like an attempt to bring the server down with tons of login attempts.

I think it is a combination of both ("let's slow them down and if we can gain access, we've hit the bonus round").

We've been on the receiving end of what I firmly believe to be a very "targeted" attack on us for almost the last two months running and while the origin "appears" to be US, Russia, and Africa - I do not believe that is the true origin of the attacks.

[wonderpunter]

Can they try to overrun and slow down your server with these sorts of things, or is it a legit attempt to hack the site? I've had some stuff like this, I guess one way of easily keeping your sites a bit more secure is to not have the 'admin' username as standard. I always choose another username which seems to immediately fend off some crude hacking attempts. With mine it seemed more like an attempt to bring the server down with tons of login attempts.

They would need quite a few attempts to slow your server, i get a lot from Denmark, Sweden and the USA I use Cloudflare which is pretty good at eliminating a large amount of suspicious traffic and then wordfence does another good job of catching what cloudflare lets through, couple that with a strong password you don't need to sweat

[MMM]

Always had a few per day but the past 3 days it's every 1-2 minutes.

[sweetbet]

I get tons of attempts from Ukraine, Russia and China. Adding a captcha WP plugin (ie. SI CAPTCHA Anti-Spam) is a great way of making sure that those automated login attempts never succeed.

[GambleThenWin]

sweetbet, can you recommend a captcha plugin?

[universal4]

Use all-in-one-wpsecurity and MOVE the login page and the majority of the problem GOES AWAY!

Pick a word that ONLY YOU know.

As a standard some search bots (used by bad actors) look for the default page wp-login and if found the domain is put on a list for brute force attacks later.

I have seen sites where I forgot to move the url and have seen thousands and thousands of attempts per hour.

Rick
Universal4

[sweetbet]

sweetbet, can you recommend a captcha plugin?

I can recommend https://wordpress.org/plugins/si-captcha-for-wordpress/

[xecutable]

Rick if you move the URL, will this break any login? Or mind sharing a proper guide of doing it?

[casasdeapostas.info]

You can manage this is several ways:

- a simple but (almost) always effective plugin, IQ block country, will block about 80-90% of the traffic from specific countries (I have blocked everything near Russia here)

- WP Cerber plugin, it limits login attempts and block IPs. There's an option to change admin page and block the access to wp-admin.php file. There's also a very useful option to block every IP that tries to login with an invalid username. So, you just need to create a new admin account without the words "admin" "administrator", etc.. then delete the old ones, and when someone tries to login as admin, booom - blocked (it can be forever, if you want). https://wordpress.org/plugins/wp-cerber/

- I have some specific IP ranges banned on server level and on Wordpress too. (mostly IPs from Israel). I've had a few attacks from Israel in the past... that's where lots of affiliates companies are located.. (coincidence? no, I know who they are.. but let's move on).

[vardan]

The same here. I've moved the usual wordpress login page(wp-login.php) and I see only a huge amount of 404 errors for that page. The plugin mentioned by Rick, all in one wp security, is a great tool, just try it and you will see the benefit. For the hackers it will be extremely hard to find the custom login page. Also Limit login attempts and Stealth login page plugins can help you to secure your site.

[alin04]

Universal4, how to MOVE the login page?

[universal4]

To move the login.

#1) Backup everything

#2) Install the all-in-one-wpsecurity plugin

#3) Go to the Brute Force and look for (Rename Login Page Settings) section and pick a word to use and enable it and "Save Settings"

#4) Log out and then log back in at the new url http://www.domain.com/wordchosen

Then check out some of the other features if they would be handy for you or would help fit into your overall security strategy.

Rick
Universal4

[alin04]

Thanks Rick.
And all the webmasters said that wp is the best platform for a site. I don t see this kind of atacks on blogger.

[xecutable]

Because blogger isnt as popular and therefore pointless to target. The thing that makes wordpress so damn appealing is the millions of plugins and themes out there, making impossible is nothing (yah sue me Adidas for using it). Thanks Rick, will look into it.