How do I protect my Wordpress/Apache website from a brute-force botnet attack?

Question

There's something (a botnet?) that is apparently attacking my Wordpress site. I see lots of entries like this in the Apache access logs, several per second:

46.105.113.8 - - [14/Apr/2013:22:57:18 -0400] "POST /blog//wp-login.php HTTP/1.1" 200 4115 "-" "Mozilla/5.0 (X11; U; Linux i686; pt-BR; rv:1.9.0.15) Gecko/20091028 15 Ubuntu/9.04 (jaunty) Firefox/3.0.15"
74.207.229.103 - - [14/Apr/2013:22:57:19 -0400] "POST /wp-cron.php?doing_wp_cron=1365994639.0381069183349609375000 HTTP/1.0" 200 222 "-" "WordPress/3.5.1; http://mysite.com"

I am thinking that something is trying to brute-force guess passwords.

One idea I had would be to block all requests to wp-login.php, except for my home IP address. How would I accomplish this?

Or is there a Wordpress plugin that will block these brute-force attacks automatically?

Or is there a better idea?

I'm running Apache 2.2.22 on Ubuntu 12.04.

Answer 1

On the large scale (for multiple sites), I'd recommend a Mod Security rule to monitor POSTs on wp-login.php, and will block after a certain number. On the smaller scale, I'd recommend something like:

http://wordpress.org/extend/plugins/better-wp-security/

In each case I've seen, changing the login URL (a feature of the plugin), pretty well mitigates that. You can also manage IP access as well - though you can also do this via .htaccess in the wp-admin directory.

Answer 2

Thanks nerve for the pointers.

Here's a couple of Wordpress plugins that will block IP addresses after a number of failed login attempts:

• Better WP Security
• Wordfence

Since I had a bunch of Wordpress sites and wanted to stop the attacks fast, I didn't want to install the plugins everywhere... Here's what I ended up doing:

1. Installed Apache mod_security by using the instructions in How to install mod_security on Ubuntu 12.04 – as nerve said, mod_security is an Apache module that helps prevent attacks like this, and does a lot of other cool security stuff. I followed the instructions in the article above to install the default rule set.
2. Found my IP address of my home network by typing “What is my IP address” into Google.
3. I added the following rules into my /etc/modsecurity/modsecurity.conf file:

    # site configuration
    # allow all access from home
    SecRule REMOTE_ADDR "^1.2.3.4" phase:1,nolog,allow,ctl:ruleEngine=off
    # deny all access to wp-login to prevent wordpress botnet attacks
    SecRule REQUEST_URI "@rx (.*)wp-login.php(.*)" deny,nolog

1. I replaced the 1.2.3.4 with my home IP address. (You can have multiple lines like this if you access your WordPress site from multiple IP addresses, but I didn't need that.)
2. I restarted Apache: $ sudo /etc/init.d/apache2 restart That was it - it stopped the botnet attack. I checked my Apache logs to see that instead of success codes (200), there were 403 error codes being returned for the botnet requests.

Eventually the botnet gave up and stopped the POST attempts.

I'll probably go back and install one of those two plugins later when I have time.