What is the best way to stop attacks at wp-login.php?
In the access logs of my server I find thousands of attempts to access wp-login.php, but none of the sites on my server is wordpress...
37.19.108.121 - - [19/Dec/2018:02:31:10 +0000] "GET /wp-login.php HTTP/1.1" 301 525 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
37.19.108.121 - - [19/Dec/2018:02:31:11 +0000] "GET /wp-login.php HTTP/1.1" 403 14611 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.189.156.125 - - [19/Dec/2018:02:36:14 +0000] "GET /wp-login.php HTTP/1.1" 301 527 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.189.156.125 - - [19/Dec/2018:02:36:15 +0000] "GET /wp-login.php HTTP/1.1" 403 3732 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:40:04 +0000] "GET /wp-login.php HTTP/1.1" 301 535 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:40:05 +0000] "GET /wp-login.php HTTP/1.1" 403 3748 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
37.19.108.121 - - [19/Dec/2018:02:40:34 +0000] "GET /wp-login.php HTTP/1.1" 301 535 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
37.19.108.121 - - [19/Dec/2018:02:40:36 +0000] "GET /wp-login.php HTTP/1.1" 403 14663 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
116.199.102.237 - - [19/Dec/2018:02:48:04 +0000] "GET /wp-login.php HTTP/1.1" 301 525 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
116.199.102.237 - - [19/Dec/2018:02:48:04 +0000] "GET /wp-login.php HTTP/1.1" 403 3907 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
201.92.187.24 - - [19/Dec/2018:02:48:32 +0000] "GET /wp-login.php HTTP/1.1" 301 537 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
201.92.187.24 - - [19/Dec/2018:02:48:33 +0000] "GET /wp-login.php HTTP/1.1" 403 16139 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:52:44 +0000] "GET /wp-login.php HTTP/1.1" 301 533 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:52:45 +0000] "GET /wp-login.php HTTP/1.1" 403 3565 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.215.42.142 - - [19/Dec/2018:03:01:40 +0000] "GET /wp-login.php HTTP/1.1" 301 521 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.215.42.142 - - [19/Dec/2018:03:01:41 +0000] "GET /wp-login.php HTTP/1.1" 403 21504 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
In my htaccess I added this rule:
RewriteCond %{REQUEST_URI} wp-login.php$ [NC]
RewriteRule . - [F,L]
But my server is always overloaded anyway.
I started to add the IPs to UFW, but they are now thousands and every day I find new ones. And probably the IPs will be dynamic and never end...
What is the best way to block these attacks without overloading the server?
I tried Fail2ban, after some online search I created this filter:
/etc/fail2ban/filter.d/wp-login.conf
[Definition]
failregex = ^<HOST> .* "POST .*wp-login.php
^<HOST> .* "GET .*wp-login.php
^<HOST> .* "POST .*xmlrpc.php
ignoreregex =
And added this to jail.local
[wp-login]
enabled = true
port = http,https
filter = wp-login
action = iptables-multiport[name=wp-login, port="http,https", protocol=tcp]
logpath = /var/log/apache2/access.log
maxretry = 1
findtime = 600
But at some point was banned my IP... but I never went on wp-login.php, What's wrong? Can someone help me understand and configure fail2ban?
I removed the 3 lines and I left only one
failregex = ^<HOST> .* "GET .*/wp-login.php
seems to work better... I have no idea why, the guides I read say that you can put more rules on different lines...???
ufw
add a comment |
In the access logs of my server I find thousands of attempts to access wp-login.php, but none of the sites on my server is wordpress...
37.19.108.121 - - [19/Dec/2018:02:31:10 +0000] "GET /wp-login.php HTTP/1.1" 301 525 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
37.19.108.121 - - [19/Dec/2018:02:31:11 +0000] "GET /wp-login.php HTTP/1.1" 403 14611 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.189.156.125 - - [19/Dec/2018:02:36:14 +0000] "GET /wp-login.php HTTP/1.1" 301 527 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.189.156.125 - - [19/Dec/2018:02:36:15 +0000] "GET /wp-login.php HTTP/1.1" 403 3732 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:40:04 +0000] "GET /wp-login.php HTTP/1.1" 301 535 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:40:05 +0000] "GET /wp-login.php HTTP/1.1" 403 3748 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
37.19.108.121 - - [19/Dec/2018:02:40:34 +0000] "GET /wp-login.php HTTP/1.1" 301 535 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
37.19.108.121 - - [19/Dec/2018:02:40:36 +0000] "GET /wp-login.php HTTP/1.1" 403 14663 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
116.199.102.237 - - [19/Dec/2018:02:48:04 +0000] "GET /wp-login.php HTTP/1.1" 301 525 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
116.199.102.237 - - [19/Dec/2018:02:48:04 +0000] "GET /wp-login.php HTTP/1.1" 403 3907 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
201.92.187.24 - - [19/Dec/2018:02:48:32 +0000] "GET /wp-login.php HTTP/1.1" 301 537 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
201.92.187.24 - - [19/Dec/2018:02:48:33 +0000] "GET /wp-login.php HTTP/1.1" 403 16139 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:52:44 +0000] "GET /wp-login.php HTTP/1.1" 301 533 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:52:45 +0000] "GET /wp-login.php HTTP/1.1" 403 3565 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.215.42.142 - - [19/Dec/2018:03:01:40 +0000] "GET /wp-login.php HTTP/1.1" 301 521 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.215.42.142 - - [19/Dec/2018:03:01:41 +0000] "GET /wp-login.php HTTP/1.1" 403 21504 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
In my htaccess I added this rule:
RewriteCond %{REQUEST_URI} wp-login.php$ [NC]
RewriteRule . - [F,L]
But my server is always overloaded anyway.
I started to add the IPs to UFW, but they are now thousands and every day I find new ones. And probably the IPs will be dynamic and never end...
What is the best way to block these attacks without overloading the server?
I tried Fail2ban, after some online search I created this filter:
/etc/fail2ban/filter.d/wp-login.conf
[Definition]
failregex = ^<HOST> .* "POST .*wp-login.php
^<HOST> .* "GET .*wp-login.php
^<HOST> .* "POST .*xmlrpc.php
ignoreregex =
And added this to jail.local
[wp-login]
enabled = true
port = http,https
filter = wp-login
action = iptables-multiport[name=wp-login, port="http,https", protocol=tcp]
logpath = /var/log/apache2/access.log
maxretry = 1
findtime = 600
But at some point was banned my IP... but I never went on wp-login.php, What's wrong? Can someone help me understand and configure fail2ban?
I removed the 3 lines and I left only one
failregex = ^<HOST> .* "GET .*/wp-login.php
seems to work better... I have no idea why, the guides I read say that you can put more rules on different lines...???
ufw
3
Have you tried to search ddos protection with fail2ban? It can read apache or nginx log and ban the ip using iptables in realtime, which should help your server loading problem. For example you can match wp-login.php and ban the ips.
– Alvin Liang
Dec 19 at 4:28
I like the idea of Failtoban, but many of the guides that I find are for Ubuntu 14.04, I always had the doubt that it was very old, perhaps not more current and updated, but maybe it's just my idea, can you confirm or deny?
– alebal
Dec 19 at 4:35
2
fail2ban is a still-active project and supports ipv6 now: github.com/fail2ban/fail2ban I never use it for http though so I can't provide exact answer, but there should be many out there.
– Alvin Liang
Dec 19 at 7:10
add a comment |
In the access logs of my server I find thousands of attempts to access wp-login.php, but none of the sites on my server is wordpress...
37.19.108.121 - - [19/Dec/2018:02:31:10 +0000] "GET /wp-login.php HTTP/1.1" 301 525 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
37.19.108.121 - - [19/Dec/2018:02:31:11 +0000] "GET /wp-login.php HTTP/1.1" 403 14611 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.189.156.125 - - [19/Dec/2018:02:36:14 +0000] "GET /wp-login.php HTTP/1.1" 301 527 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.189.156.125 - - [19/Dec/2018:02:36:15 +0000] "GET /wp-login.php HTTP/1.1" 403 3732 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:40:04 +0000] "GET /wp-login.php HTTP/1.1" 301 535 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:40:05 +0000] "GET /wp-login.php HTTP/1.1" 403 3748 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
37.19.108.121 - - [19/Dec/2018:02:40:34 +0000] "GET /wp-login.php HTTP/1.1" 301 535 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
37.19.108.121 - - [19/Dec/2018:02:40:36 +0000] "GET /wp-login.php HTTP/1.1" 403 14663 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
116.199.102.237 - - [19/Dec/2018:02:48:04 +0000] "GET /wp-login.php HTTP/1.1" 301 525 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
116.199.102.237 - - [19/Dec/2018:02:48:04 +0000] "GET /wp-login.php HTTP/1.1" 403 3907 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
201.92.187.24 - - [19/Dec/2018:02:48:32 +0000] "GET /wp-login.php HTTP/1.1" 301 537 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
201.92.187.24 - - [19/Dec/2018:02:48:33 +0000] "GET /wp-login.php HTTP/1.1" 403 16139 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:52:44 +0000] "GET /wp-login.php HTTP/1.1" 301 533 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:52:45 +0000] "GET /wp-login.php HTTP/1.1" 403 3565 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.215.42.142 - - [19/Dec/2018:03:01:40 +0000] "GET /wp-login.php HTTP/1.1" 301 521 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.215.42.142 - - [19/Dec/2018:03:01:41 +0000] "GET /wp-login.php HTTP/1.1" 403 21504 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
In my htaccess I added this rule:
RewriteCond %{REQUEST_URI} wp-login.php$ [NC]
RewriteRule . - [F,L]
But my server is always overloaded anyway.
I started to add the IPs to UFW, but they are now thousands and every day I find new ones. And probably the IPs will be dynamic and never end...
What is the best way to block these attacks without overloading the server?
I tried Fail2ban, after some online search I created this filter:
/etc/fail2ban/filter.d/wp-login.conf
[Definition]
failregex = ^<HOST> .* "POST .*wp-login.php
^<HOST> .* "GET .*wp-login.php
^<HOST> .* "POST .*xmlrpc.php
ignoreregex =
And added this to jail.local
[wp-login]
enabled = true
port = http,https
filter = wp-login
action = iptables-multiport[name=wp-login, port="http,https", protocol=tcp]
logpath = /var/log/apache2/access.log
maxretry = 1
findtime = 600
But at some point was banned my IP... but I never went on wp-login.php, What's wrong? Can someone help me understand and configure fail2ban?
I removed the 3 lines and I left only one
failregex = ^<HOST> .* "GET .*/wp-login.php
seems to work better... I have no idea why, the guides I read say that you can put more rules on different lines...???
ufw
In the access logs of my server I find thousands of attempts to access wp-login.php, but none of the sites on my server is wordpress...
37.19.108.121 - - [19/Dec/2018:02:31:10 +0000] "GET /wp-login.php HTTP/1.1" 301 525 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
37.19.108.121 - - [19/Dec/2018:02:31:11 +0000] "GET /wp-login.php HTTP/1.1" 403 14611 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.189.156.125 - - [19/Dec/2018:02:36:14 +0000] "GET /wp-login.php HTTP/1.1" 301 527 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.189.156.125 - - [19/Dec/2018:02:36:15 +0000] "GET /wp-login.php HTTP/1.1" 403 3732 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:40:04 +0000] "GET /wp-login.php HTTP/1.1" 301 535 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:40:05 +0000] "GET /wp-login.php HTTP/1.1" 403 3748 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
37.19.108.121 - - [19/Dec/2018:02:40:34 +0000] "GET /wp-login.php HTTP/1.1" 301 535 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
37.19.108.121 - - [19/Dec/2018:02:40:36 +0000] "GET /wp-login.php HTTP/1.1" 403 14663 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
116.199.102.237 - - [19/Dec/2018:02:48:04 +0000] "GET /wp-login.php HTTP/1.1" 301 525 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
116.199.102.237 - - [19/Dec/2018:02:48:04 +0000] "GET /wp-login.php HTTP/1.1" 403 3907 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
201.92.187.24 - - [19/Dec/2018:02:48:32 +0000] "GET /wp-login.php HTTP/1.1" 301 537 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
201.92.187.24 - - [19/Dec/2018:02:48:33 +0000] "GET /wp-login.php HTTP/1.1" 403 16139 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:52:44 +0000] "GET /wp-login.php HTTP/1.1" 301 533 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
58.26.43.39 - - [19/Dec/2018:02:52:45 +0000] "GET /wp-login.php HTTP/1.1" 403 3565 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.215.42.142 - - [19/Dec/2018:03:01:40 +0000] "GET /wp-login.php HTTP/1.1" 301 521 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
179.215.42.142 - - [19/Dec/2018:03:01:41 +0000] "GET /wp-login.php HTTP/1.1" 403 21504 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
In my htaccess I added this rule:
RewriteCond %{REQUEST_URI} wp-login.php$ [NC]
RewriteRule . - [F,L]
But my server is always overloaded anyway.
I started to add the IPs to UFW, but they are now thousands and every day I find new ones. And probably the IPs will be dynamic and never end...
What is the best way to block these attacks without overloading the server?
I tried Fail2ban, after some online search I created this filter:
/etc/fail2ban/filter.d/wp-login.conf
[Definition]
failregex = ^<HOST> .* "POST .*wp-login.php
^<HOST> .* "GET .*wp-login.php
^<HOST> .* "POST .*xmlrpc.php
ignoreregex =
And added this to jail.local
[wp-login]
enabled = true
port = http,https
filter = wp-login
action = iptables-multiport[name=wp-login, port="http,https", protocol=tcp]
logpath = /var/log/apache2/access.log
maxretry = 1
findtime = 600
But at some point was banned my IP... but I never went on wp-login.php, What's wrong? Can someone help me understand and configure fail2ban?
I removed the 3 lines and I left only one
failregex = ^<HOST> .* "GET .*/wp-login.php
seems to work better... I have no idea why, the guides I read say that you can put more rules on different lines...???
ufw
ufw
edited Dec 21 at 4:37
asked Dec 19 at 3:19
alebal
1115
1115
3
Have you tried to search ddos protection with fail2ban? It can read apache or nginx log and ban the ip using iptables in realtime, which should help your server loading problem. For example you can match wp-login.php and ban the ips.
– Alvin Liang
Dec 19 at 4:28
I like the idea of Failtoban, but many of the guides that I find are for Ubuntu 14.04, I always had the doubt that it was very old, perhaps not more current and updated, but maybe it's just my idea, can you confirm or deny?
– alebal
Dec 19 at 4:35
2
fail2ban is a still-active project and supports ipv6 now: github.com/fail2ban/fail2ban I never use it for http though so I can't provide exact answer, but there should be many out there.
– Alvin Liang
Dec 19 at 7:10
add a comment |
3
Have you tried to search ddos protection with fail2ban? It can read apache or nginx log and ban the ip using iptables in realtime, which should help your server loading problem. For example you can match wp-login.php and ban the ips.
– Alvin Liang
Dec 19 at 4:28
I like the idea of Failtoban, but many of the guides that I find are for Ubuntu 14.04, I always had the doubt that it was very old, perhaps not more current and updated, but maybe it's just my idea, can you confirm or deny?
– alebal
Dec 19 at 4:35
2
fail2ban is a still-active project and supports ipv6 now: github.com/fail2ban/fail2ban I never use it for http though so I can't provide exact answer, but there should be many out there.
– Alvin Liang
Dec 19 at 7:10
3
3
Have you tried to search ddos protection with fail2ban? It can read apache or nginx log and ban the ip using iptables in realtime, which should help your server loading problem. For example you can match wp-login.php and ban the ips.
– Alvin Liang
Dec 19 at 4:28
Have you tried to search ddos protection with fail2ban? It can read apache or nginx log and ban the ip using iptables in realtime, which should help your server loading problem. For example you can match wp-login.php and ban the ips.
– Alvin Liang
Dec 19 at 4:28
I like the idea of Failtoban, but many of the guides that I find are for Ubuntu 14.04, I always had the doubt that it was very old, perhaps not more current and updated, but maybe it's just my idea, can you confirm or deny?
– alebal
Dec 19 at 4:35
I like the idea of Failtoban, but many of the guides that I find are for Ubuntu 14.04, I always had the doubt that it was very old, perhaps not more current and updated, but maybe it's just my idea, can you confirm or deny?
– alebal
Dec 19 at 4:35
2
2
fail2ban is a still-active project and supports ipv6 now: github.com/fail2ban/fail2ban I never use it for http though so I can't provide exact answer, but there should be many out there.
– Alvin Liang
Dec 19 at 7:10
fail2ban is a still-active project and supports ipv6 now: github.com/fail2ban/fail2ban I never use it for http though so I can't provide exact answer, but there should be many out there.
– Alvin Liang
Dec 19 at 7:10
add a comment |
1 Answer
1
active
oldest
votes
In order to password protect a page with Apache, you need to add a new section to your Apache VirtualHost like the below:
<DirectoryMatch ^.*/wp-admin/>
AuthType Basic
AuthName "Restricted"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
</DirectoryMatch>
Then set the user and password by running:
sudo htpasswd -c /etc/apache2/.htpasswd username
Finally, restart Apache for the changes to take effect:
sudo service apache2 restart
then add this code your .htaccess
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
# require www and https
# comment out the first two if you do not need www
# comment out all lines for local dev
RewriteCond %{HTTP_HOST} !^www. [NC]
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [NE,L,R=301]
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [NE,L,R=301]
RewriteRule ^index.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
## PROTECT .HTACCESS, ERROR LOGS, WP-CONFIG.PHP AND PHP.INI FILES ##
<FilesMatch "^.*(error_log|wp-config.php|php.ini|.[hH][tT][aApP].*)$">
Order deny,allow
Deny from all
</FilesMatch>
## PREVENT WORDPRESS DIRECTORY BROWSING ##
Options All -Indexes
## PROTECT IMPORTANT PHP FILES ##
RewriteCond %{REQUEST_URI} !^/wp-content/plugins/mu-plugins/
RewriteRule wp-content/plugins/(.*.php)$ - [R=404,L]
RewriteCond %{REQUEST_URI} !^/wp-content/themes/V2/
RewriteRule wp-content/themes/(.*.php)$ - [R=404,L]
# Block the include-only files.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>
## COMPRESS TEXT, HTML, JAVASCRIPT, CSS, XML ##
## BEGIN GZIP ##
<IfModule mod_deflate.c>
# The following line is enough for .js and .css .html
AddOutputFilter DEFLATE js css html
AddOutputFilterByType DEFLATE text/text text/html text/plain text/xml application/xhtml+xml text/css application/xml application/rss+xml application/atom_xml application/x-javascript application/javascript application/x-httpd-php application/x-httpd-fastphp text/html
# The following lines are to avoid bugs with some browsers
BrowserMatch ^Mozilla/4 gzip-only-text/html
BrowserMatch ^Mozilla/4.0[678] no-gzip
BrowserMatch bMSIE !no-gzip !gzip-only-text/html
</IfModule>
# BEGIN EXPIRES
<IfModule mod_expires.c>
ExpiresActive On
ExpiresDefault "access plus 10 days"
ExpiresByType text/css "access plus 1 week"
ExpiresByType text/plain "access plus 1 month"
ExpiresByType image/gif "access plus 1 month"
ExpiresByType image/png "access plus 1 month"
ExpiresByType image/jpeg "access plus 1 month"
ExpiresByType application/x-javascript "access plus 1 month"
ExpiresByType application/javascript "access plus 1 week"
ExpiresByType application/x-icon "access plus 1 year"
</IfModule>
<IfModule mod_headers.c>
<FilesMatch ".(js|css|xml|gz)$">
Header append Vary Accept-Encoding
</FilesMatch>
<FilesMatch ".(ico|jpe?g|png|gif|swf)$">
Header set Cache-Control "public"
</FilesMatch>
<FilesMatch ".(css)$">
Header set Cache-Control "public"
</FilesMatch>
<FilesMatch ".(js)$">
Header set Cache-Control "private"
</FilesMatch>
<FilesMatch ".(x?html?|php)$">
Header set Cache-Control "private, must-revalidate"
</FilesMatch>
</IfModule>
## END OF HTACCESS
my sites is not wordpress... I don't want protect a directory, I want block the attack...
– alebal
Dec 20 at 4:40
then leave its its go 404 :) its py bot github.com/Ghost173/php-webshells its web shell its auto try
– GHOST
Dec 20 at 4:43
in your log 403 its mean permission dined are you sure you donat have wp-login?
– GHOST
Dec 20 at 4:44
1
I add a rule in htaccess as write in the first post
– alebal
Dec 20 at 4:49
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "89"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1102995%2fwhat-is-the-best-way-to-stop-attacks-at-wp-login-php%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
In order to password protect a page with Apache, you need to add a new section to your Apache VirtualHost like the below:
<DirectoryMatch ^.*/wp-admin/>
AuthType Basic
AuthName "Restricted"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
</DirectoryMatch>
Then set the user and password by running:
sudo htpasswd -c /etc/apache2/.htpasswd username
Finally, restart Apache for the changes to take effect:
sudo service apache2 restart
then add this code your .htaccess
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
# require www and https
# comment out the first two if you do not need www
# comment out all lines for local dev
RewriteCond %{HTTP_HOST} !^www. [NC]
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [NE,L,R=301]
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [NE,L,R=301]
RewriteRule ^index.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
## PROTECT .HTACCESS, ERROR LOGS, WP-CONFIG.PHP AND PHP.INI FILES ##
<FilesMatch "^.*(error_log|wp-config.php|php.ini|.[hH][tT][aApP].*)$">
Order deny,allow
Deny from all
</FilesMatch>
## PREVENT WORDPRESS DIRECTORY BROWSING ##
Options All -Indexes
## PROTECT IMPORTANT PHP FILES ##
RewriteCond %{REQUEST_URI} !^/wp-content/plugins/mu-plugins/
RewriteRule wp-content/plugins/(.*.php)$ - [R=404,L]
RewriteCond %{REQUEST_URI} !^/wp-content/themes/V2/
RewriteRule wp-content/themes/(.*.php)$ - [R=404,L]
# Block the include-only files.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>
## COMPRESS TEXT, HTML, JAVASCRIPT, CSS, XML ##
## BEGIN GZIP ##
<IfModule mod_deflate.c>
# The following line is enough for .js and .css .html
AddOutputFilter DEFLATE js css html
AddOutputFilterByType DEFLATE text/text text/html text/plain text/xml application/xhtml+xml text/css application/xml application/rss+xml application/atom_xml application/x-javascript application/javascript application/x-httpd-php application/x-httpd-fastphp text/html
# The following lines are to avoid bugs with some browsers
BrowserMatch ^Mozilla/4 gzip-only-text/html
BrowserMatch ^Mozilla/4.0[678] no-gzip
BrowserMatch bMSIE !no-gzip !gzip-only-text/html
</IfModule>
# BEGIN EXPIRES
<IfModule mod_expires.c>
ExpiresActive On
ExpiresDefault "access plus 10 days"
ExpiresByType text/css "access plus 1 week"
ExpiresByType text/plain "access plus 1 month"
ExpiresByType image/gif "access plus 1 month"
ExpiresByType image/png "access plus 1 month"
ExpiresByType image/jpeg "access plus 1 month"
ExpiresByType application/x-javascript "access plus 1 month"
ExpiresByType application/javascript "access plus 1 week"
ExpiresByType application/x-icon "access plus 1 year"
</IfModule>
<IfModule mod_headers.c>
<FilesMatch ".(js|css|xml|gz)$">
Header append Vary Accept-Encoding
</FilesMatch>
<FilesMatch ".(ico|jpe?g|png|gif|swf)$">
Header set Cache-Control "public"
</FilesMatch>
<FilesMatch ".(css)$">
Header set Cache-Control "public"
</FilesMatch>
<FilesMatch ".(js)$">
Header set Cache-Control "private"
</FilesMatch>
<FilesMatch ".(x?html?|php)$">
Header set Cache-Control "private, must-revalidate"
</FilesMatch>
</IfModule>
## END OF HTACCESS
my sites is not wordpress... I don't want protect a directory, I want block the attack...
– alebal
Dec 20 at 4:40
then leave its its go 404 :) its py bot github.com/Ghost173/php-webshells its web shell its auto try
– GHOST
Dec 20 at 4:43
in your log 403 its mean permission dined are you sure you donat have wp-login?
– GHOST
Dec 20 at 4:44
1
I add a rule in htaccess as write in the first post
– alebal
Dec 20 at 4:49
add a comment |
In order to password protect a page with Apache, you need to add a new section to your Apache VirtualHost like the below:
<DirectoryMatch ^.*/wp-admin/>
AuthType Basic
AuthName "Restricted"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
</DirectoryMatch>
Then set the user and password by running:
sudo htpasswd -c /etc/apache2/.htpasswd username
Finally, restart Apache for the changes to take effect:
sudo service apache2 restart
then add this code your .htaccess
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
# require www and https
# comment out the first two if you do not need www
# comment out all lines for local dev
RewriteCond %{HTTP_HOST} !^www. [NC]
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [NE,L,R=301]
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [NE,L,R=301]
RewriteRule ^index.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
## PROTECT .HTACCESS, ERROR LOGS, WP-CONFIG.PHP AND PHP.INI FILES ##
<FilesMatch "^.*(error_log|wp-config.php|php.ini|.[hH][tT][aApP].*)$">
Order deny,allow
Deny from all
</FilesMatch>
## PREVENT WORDPRESS DIRECTORY BROWSING ##
Options All -Indexes
## PROTECT IMPORTANT PHP FILES ##
RewriteCond %{REQUEST_URI} !^/wp-content/plugins/mu-plugins/
RewriteRule wp-content/plugins/(.*.php)$ - [R=404,L]
RewriteCond %{REQUEST_URI} !^/wp-content/themes/V2/
RewriteRule wp-content/themes/(.*.php)$ - [R=404,L]
# Block the include-only files.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>
## COMPRESS TEXT, HTML, JAVASCRIPT, CSS, XML ##
## BEGIN GZIP ##
<IfModule mod_deflate.c>
# The following line is enough for .js and .css .html
AddOutputFilter DEFLATE js css html
AddOutputFilterByType DEFLATE text/text text/html text/plain text/xml application/xhtml+xml text/css application/xml application/rss+xml application/atom_xml application/x-javascript application/javascript application/x-httpd-php application/x-httpd-fastphp text/html
# The following lines are to avoid bugs with some browsers
BrowserMatch ^Mozilla/4 gzip-only-text/html
BrowserMatch ^Mozilla/4.0[678] no-gzip
BrowserMatch bMSIE !no-gzip !gzip-only-text/html
</IfModule>
# BEGIN EXPIRES
<IfModule mod_expires.c>
ExpiresActive On
ExpiresDefault "access plus 10 days"
ExpiresByType text/css "access plus 1 week"
ExpiresByType text/plain "access plus 1 month"
ExpiresByType image/gif "access plus 1 month"
ExpiresByType image/png "access plus 1 month"
ExpiresByType image/jpeg "access plus 1 month"
ExpiresByType application/x-javascript "access plus 1 month"
ExpiresByType application/javascript "access plus 1 week"
ExpiresByType application/x-icon "access plus 1 year"
</IfModule>
<IfModule mod_headers.c>
<FilesMatch ".(js|css|xml|gz)$">
Header append Vary Accept-Encoding
</FilesMatch>
<FilesMatch ".(ico|jpe?g|png|gif|swf)$">
Header set Cache-Control "public"
</FilesMatch>
<FilesMatch ".(css)$">
Header set Cache-Control "public"
</FilesMatch>
<FilesMatch ".(js)$">
Header set Cache-Control "private"
</FilesMatch>
<FilesMatch ".(x?html?|php)$">
Header set Cache-Control "private, must-revalidate"
</FilesMatch>
</IfModule>
## END OF HTACCESS
my sites is not wordpress... I don't want protect a directory, I want block the attack...
– alebal
Dec 20 at 4:40
then leave its its go 404 :) its py bot github.com/Ghost173/php-webshells its web shell its auto try
– GHOST
Dec 20 at 4:43
in your log 403 its mean permission dined are you sure you donat have wp-login?
– GHOST
Dec 20 at 4:44
1
I add a rule in htaccess as write in the first post
– alebal
Dec 20 at 4:49
add a comment |
In order to password protect a page with Apache, you need to add a new section to your Apache VirtualHost like the below:
<DirectoryMatch ^.*/wp-admin/>
AuthType Basic
AuthName "Restricted"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
</DirectoryMatch>
Then set the user and password by running:
sudo htpasswd -c /etc/apache2/.htpasswd username
Finally, restart Apache for the changes to take effect:
sudo service apache2 restart
then add this code your .htaccess
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
# require www and https
# comment out the first two if you do not need www
# comment out all lines for local dev
RewriteCond %{HTTP_HOST} !^www. [NC]
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [NE,L,R=301]
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [NE,L,R=301]
RewriteRule ^index.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
## PROTECT .HTACCESS, ERROR LOGS, WP-CONFIG.PHP AND PHP.INI FILES ##
<FilesMatch "^.*(error_log|wp-config.php|php.ini|.[hH][tT][aApP].*)$">
Order deny,allow
Deny from all
</FilesMatch>
## PREVENT WORDPRESS DIRECTORY BROWSING ##
Options All -Indexes
## PROTECT IMPORTANT PHP FILES ##
RewriteCond %{REQUEST_URI} !^/wp-content/plugins/mu-plugins/
RewriteRule wp-content/plugins/(.*.php)$ - [R=404,L]
RewriteCond %{REQUEST_URI} !^/wp-content/themes/V2/
RewriteRule wp-content/themes/(.*.php)$ - [R=404,L]
# Block the include-only files.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>
## COMPRESS TEXT, HTML, JAVASCRIPT, CSS, XML ##
## BEGIN GZIP ##
<IfModule mod_deflate.c>
# The following line is enough for .js and .css .html
AddOutputFilter DEFLATE js css html
AddOutputFilterByType DEFLATE text/text text/html text/plain text/xml application/xhtml+xml text/css application/xml application/rss+xml application/atom_xml application/x-javascript application/javascript application/x-httpd-php application/x-httpd-fastphp text/html
# The following lines are to avoid bugs with some browsers
BrowserMatch ^Mozilla/4 gzip-only-text/html
BrowserMatch ^Mozilla/4.0[678] no-gzip
BrowserMatch bMSIE !no-gzip !gzip-only-text/html
</IfModule>
# BEGIN EXPIRES
<IfModule mod_expires.c>
ExpiresActive On
ExpiresDefault "access plus 10 days"
ExpiresByType text/css "access plus 1 week"
ExpiresByType text/plain "access plus 1 month"
ExpiresByType image/gif "access plus 1 month"
ExpiresByType image/png "access plus 1 month"
ExpiresByType image/jpeg "access plus 1 month"
ExpiresByType application/x-javascript "access plus 1 month"
ExpiresByType application/javascript "access plus 1 week"
ExpiresByType application/x-icon "access plus 1 year"
</IfModule>
<IfModule mod_headers.c>
<FilesMatch ".(js|css|xml|gz)$">
Header append Vary Accept-Encoding
</FilesMatch>
<FilesMatch ".(ico|jpe?g|png|gif|swf)$">
Header set Cache-Control "public"
</FilesMatch>
<FilesMatch ".(css)$">
Header set Cache-Control "public"
</FilesMatch>
<FilesMatch ".(js)$">
Header set Cache-Control "private"
</FilesMatch>
<FilesMatch ".(x?html?|php)$">
Header set Cache-Control "private, must-revalidate"
</FilesMatch>
</IfModule>
## END OF HTACCESS
In order to password protect a page with Apache, you need to add a new section to your Apache VirtualHost like the below:
<DirectoryMatch ^.*/wp-admin/>
AuthType Basic
AuthName "Restricted"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
</DirectoryMatch>
Then set the user and password by running:
sudo htpasswd -c /etc/apache2/.htpasswd username
Finally, restart Apache for the changes to take effect:
sudo service apache2 restart
then add this code your .htaccess
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
# require www and https
# comment out the first two if you do not need www
# comment out all lines for local dev
RewriteCond %{HTTP_HOST} !^www. [NC]
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [NE,L,R=301]
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [NE,L,R=301]
RewriteRule ^index.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
## PROTECT .HTACCESS, ERROR LOGS, WP-CONFIG.PHP AND PHP.INI FILES ##
<FilesMatch "^.*(error_log|wp-config.php|php.ini|.[hH][tT][aApP].*)$">
Order deny,allow
Deny from all
</FilesMatch>
## PREVENT WORDPRESS DIRECTORY BROWSING ##
Options All -Indexes
## PROTECT IMPORTANT PHP FILES ##
RewriteCond %{REQUEST_URI} !^/wp-content/plugins/mu-plugins/
RewriteRule wp-content/plugins/(.*.php)$ - [R=404,L]
RewriteCond %{REQUEST_URI} !^/wp-content/themes/V2/
RewriteRule wp-content/themes/(.*.php)$ - [R=404,L]
# Block the include-only files.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>
## COMPRESS TEXT, HTML, JAVASCRIPT, CSS, XML ##
## BEGIN GZIP ##
<IfModule mod_deflate.c>
# The following line is enough for .js and .css .html
AddOutputFilter DEFLATE js css html
AddOutputFilterByType DEFLATE text/text text/html text/plain text/xml application/xhtml+xml text/css application/xml application/rss+xml application/atom_xml application/x-javascript application/javascript application/x-httpd-php application/x-httpd-fastphp text/html
# The following lines are to avoid bugs with some browsers
BrowserMatch ^Mozilla/4 gzip-only-text/html
BrowserMatch ^Mozilla/4.0[678] no-gzip
BrowserMatch bMSIE !no-gzip !gzip-only-text/html
</IfModule>
# BEGIN EXPIRES
<IfModule mod_expires.c>
ExpiresActive On
ExpiresDefault "access plus 10 days"
ExpiresByType text/css "access plus 1 week"
ExpiresByType text/plain "access plus 1 month"
ExpiresByType image/gif "access plus 1 month"
ExpiresByType image/png "access plus 1 month"
ExpiresByType image/jpeg "access plus 1 month"
ExpiresByType application/x-javascript "access plus 1 month"
ExpiresByType application/javascript "access plus 1 week"
ExpiresByType application/x-icon "access plus 1 year"
</IfModule>
<IfModule mod_headers.c>
<FilesMatch ".(js|css|xml|gz)$">
Header append Vary Accept-Encoding
</FilesMatch>
<FilesMatch ".(ico|jpe?g|png|gif|swf)$">
Header set Cache-Control "public"
</FilesMatch>
<FilesMatch ".(css)$">
Header set Cache-Control "public"
</FilesMatch>
<FilesMatch ".(js)$">
Header set Cache-Control "private"
</FilesMatch>
<FilesMatch ".(x?html?|php)$">
Header set Cache-Control "private, must-revalidate"
</FilesMatch>
</IfModule>
## END OF HTACCESS
edited Dec 20 at 4:42
answered Dec 20 at 4:38
GHOST
269111
269111
my sites is not wordpress... I don't want protect a directory, I want block the attack...
– alebal
Dec 20 at 4:40
then leave its its go 404 :) its py bot github.com/Ghost173/php-webshells its web shell its auto try
– GHOST
Dec 20 at 4:43
in your log 403 its mean permission dined are you sure you donat have wp-login?
– GHOST
Dec 20 at 4:44
1
I add a rule in htaccess as write in the first post
– alebal
Dec 20 at 4:49
add a comment |
my sites is not wordpress... I don't want protect a directory, I want block the attack...
– alebal
Dec 20 at 4:40
then leave its its go 404 :) its py bot github.com/Ghost173/php-webshells its web shell its auto try
– GHOST
Dec 20 at 4:43
in your log 403 its mean permission dined are you sure you donat have wp-login?
– GHOST
Dec 20 at 4:44
1
I add a rule in htaccess as write in the first post
– alebal
Dec 20 at 4:49
my sites is not wordpress... I don't want protect a directory, I want block the attack...
– alebal
Dec 20 at 4:40
my sites is not wordpress... I don't want protect a directory, I want block the attack...
– alebal
Dec 20 at 4:40
then leave its its go 404 :) its py bot github.com/Ghost173/php-webshells its web shell its auto try
– GHOST
Dec 20 at 4:43
then leave its its go 404 :) its py bot github.com/Ghost173/php-webshells its web shell its auto try
– GHOST
Dec 20 at 4:43
in your log 403 its mean permission dined are you sure you donat have wp-login?
– GHOST
Dec 20 at 4:44
in your log 403 its mean permission dined are you sure you donat have wp-login?
– GHOST
Dec 20 at 4:44
1
1
I add a rule in htaccess as write in the first post
– alebal
Dec 20 at 4:49
I add a rule in htaccess as write in the first post
– alebal
Dec 20 at 4:49
add a comment |
Thanks for contributing an answer to Ask Ubuntu!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1102995%2fwhat-is-the-best-way-to-stop-attacks-at-wp-login-php%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
3
Have you tried to search ddos protection with fail2ban? It can read apache or nginx log and ban the ip using iptables in realtime, which should help your server loading problem. For example you can match wp-login.php and ban the ips.
– Alvin Liang
Dec 19 at 4:28
I like the idea of Failtoban, but many of the guides that I find are for Ubuntu 14.04, I always had the doubt that it was very old, perhaps not more current and updated, but maybe it's just my idea, can you confirm or deny?
– alebal
Dec 19 at 4:35
2
fail2ban is a still-active project and supports ipv6 now: github.com/fail2ban/fail2ban I never use it for http though so I can't provide exact answer, but there should be many out there.
– Alvin Liang
Dec 19 at 7:10