One of my sites has been hacked recently. To make it short, i had an old version of wisiya newsletters running wich was used to upload a few files in the wp-content directory. Since then a lot of things has changed regarding the security of this domain.
Among other things i implemented a worldwide blocking for wp-login.php via .htaccess as follows:
<Files wp-login.php> Order deny,allow Deny from all Allow from my.own.static.ip.adress </Files>
I've compared the accesslogs from before and after the implementation of this change and was pleased with the results. All unauthorized access attempts were blocked with a 403 response.
Until today.... Sucuri informed me via Email that someone must have gotten access to the login form and has sent a single login request to the server.
IP Address: 188.8.131.52 Notification: User authentication failed: admin
This was after i changed the .htaccess file... As i'm still fairly new to apache and security in general, can someone explain to me how this is even possible?
Kind regards, Michael