Wordpress - hackers

Maybe some of you guys can answer me this?

I never used Wordpress before, because i usually let others do my programming. However, i decided to give it a try, and threw together a site for my own use. I know from reading this forum that many of you guys use Wordpress, and i also note that wordpress is a target for hackers. It's in this regards that i'm asking this question.

Over the past two days i've been getting an increased amount of log-in attempts from hackers. Wordfence tells me it blocks them and locks them out. If someone/somewhere is trying to get into the site, wouldn't it be showing (visitor) on my google analytics? Afterall, most of these are from you guessed it Russia, and im only seeing two visitors from that country.

This email was sent from your website by the Wordfence plugin at Friday 2nd of December 2016 at 10:21:22 AM
The Wordfence administrative URL for this site is:

A user with IP address 31.8.189.159 has been locked out from the signing in or using the password recovery form for the following reason: Used an invalid username 'administrator' to try to sign in.
User IP: 31.8.189.159
User hostname: h31-8-189-159.dyn.bashtel.ru
User location: Meleuz, Russia


I've also noticed that these people change IP and come again, and it can be from Ireland, Mexico, US etc. Obviously i can't block countries based on that --- Is their some action i should be taking?

I must admit i was thinking it's Wordfence trying to sell me an upgrade by making me paranoid. However, while i might not understand much about programming, i'm pretty good at maths. They would need many attempts to find a way in. Furthermore, i'm not sure what it would bring them in such a situation!!

I've always assumed it's done by bots rather than people physically trying to log in.

If you want extra security you could always whitelist your IP for the admin section and block everyone else (if you have a fixed IP). Or password protect the admin folder in htaccess.

It's bots. I have a dozen of those every day. Nothing to worry about to be honest.

Add a captcha plugin and a 2nd password field so that the bots will have zero chance of accessing your site. https://wordpress.org/plugins/si-captcha-for-wordpress/ https://wordpress.org/plugins/stealth-login-page/

I usually re-name the /wp-admin path and also add a captcha for the login page.

Had the same thing, was worried but nothing came of it.