Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

There's something (a botnet?) that is apparently attacking my Wordpress site. I see lots of entries like this in the Apache access logs, several per second:

46.105.113.8 - - [14/Apr/2013:22:57:18 -0400] "POST /blog//wp-login.php HTTP/1.1" 200 4115 "-" "Mozilla/5.0 (X11; U; Linux i686; pt-BR; rv:1.9.0.15) Gecko/20091028 15 Ubuntu/9.04 (jaunty) Firefox/3.0.15"
74.207.229.103 - - [14/Apr/2013:22:57:19 -0400] "POST /wp-cron.php?doing_wp_cron=1365994639.0381069183349609375000 HTTP/1.0" 200 222 "-" "WordPress/3.5.1; http://mysite.com"

I am thinking that something is trying to brute-force guess passwords.

One idea I had would be to block all requests to wp-login.php, except for my home IP address. How would I accomplish this?

Or is there a Wordpress plugin that will block these brute-force attacks automatically?

Or is there a better idea?

I'm running Apache 2.2.22 on Ubuntu 12.04.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

On the large scale (for multiple sites), I'd recommend a Mod Security rule to monitor POSTs on wp-login.php, and will block after a certain number. On the smaller scale, I'd recommend something like:

http://wordpress.org/extend/plugins/better-wp-security/

In each case I've seen, changing the login URL (a feature of the plugin), pretty well mitigates that. You can also manage IP access as well - though you can also do this via .htaccess in the wp-admin directory.

share|improve this answer

Thanks nerve for the pointers.

Here's a couple of Wordpress plugins that will block IP addresses after a number of failed login attempts:

Since I had a bunch of Wordpress sites and wanted to stop the attacks fast, I didn't want to install the plugins everywhere... Here's what I ended up doing:

  1. Installed Apache mod_security by using the instructions in How to install mod_security on Ubuntu 12.04 – as nerve said, mod_security is an Apache module that helps prevent attacks like this, and does a lot of other cool security stuff. I followed the instructions in the article above to install the default rule set.
  2. Found my IP address of my home network by typing “What is my IP address” into Google.
  3. I added the following rules into my /etc/modsecurity/modsecurity.conf file:
    # site configuration
    # allow all access from home
    SecRule REMOTE_ADDR "^1.2.3.4" phase:1,nolog,allow,ctl:ruleEngine=off
    # deny all access to wp-login to prevent wordpress botnet attacks
    SecRule REQUEST_URI "@rx (.*)wp-login.php(.*)" deny,nolog
  1. I replaced the 1.2.3.4 with my home IP address. (You can have multiple lines like this if you access your WordPress site from multiple IP addresses, but I didn't need that.)
  2. I restarted Apache: $ sudo /etc/init.d/apache2 restart That was it - it stopped the botnet attack. I checked my Apache logs to see that instead of success codes (200), there were 403 error codes being returned for the botnet requests.

Eventually the botnet gave up and stopped the POST attempts.

I'll probably go back and install one of those two plugins later when I have time.

share|improve this answer
    
That is a pretty good approach as well - best coupled with a default 403 error page, if one isn't already in place. If you have any interest, I'd be happy to post the brute force detection via modsec - they were developed with cPanel servers in mind, but can be nice in situations where specifying specific IPs per site can be cumbersome. –  nerve Apr 16 '13 at 9:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.