How to prevent wp-login brute force attack from thousand of different IP? [duplicate]

Sadly it’s not uncommon to receive many rogue login attempts. If you have a strong password policy this actually shouldn’t worry you too much.

If there is a limited amount of people with logins and they work from fixed addresses, you can block acces to that page by writing a rule in your .htaccess that blocks all visitors from wp-login.php except those with certain ip-addresses.

Also, security plugins like iThemes can track rogue plugin attempts for you, and issue bans as well as fix common security loopholes. But you can’t stop people from trying to get in, unless you decouple your site from the internet.

Related Posts:

  1. Verifying that I have fully removed a WordPress hack?
  2. If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?
  3. Tips for finding SPAM links injected into the_content
  4. What should I do about hacked server?
  5. How can I find security hole in my wordpress site?
  6. How to prevent bot or someone to modify any file automatically?
  7. wp-config.php modified?
  8. Suspicious Files
  9. Malware script in database post table only? [closed]
  10. Verifying that I have fully removed a WordPress hack?
  11. How can I safely hide the fact that my website runs on WordPress? [closed]
  12. My WordPress Websites are always under attack
  13. How to find exploited wordpress plugin [closed]
  14. Any known bugs that could cause disappearance of the wp_users table?
  15. On new server, site got hacked, permissions a bit strange? Please help
  16. Replace domain in database
  17. Remove hacked code – out of ideas! [closed]
  18. WordPress Database Re-installed (Hacked)
  19. Verifying that I have fully removed a WordPress hack?
  20. Could a user account with a stolen password compromised entire WP site?
  21. how to find the way they hacked my WP site
  22. How to stop repeated hack on header.php of custom theme? [closed]
  23. Is my WP site being hacked?
  24. Should WordPress Add Options to Enhance Security or Leave it to plugin developers? [closed]
  25. WordPress Hacks/Defacing [closed]
  26. what is a auth_user_file.txt?
  27. Is moving wp-config outside the web root really beneficial?
  28. Best way to eliminate xmlrpc.php?
  29. Should I remove install.php and install-helper.php?
  30. How do I technically prove that WordPress is secure?
  31. Which KSES should be used and when?
  32. Disable comment windows for all existing posts (pages/blogposts)
  33. How Attackers write script into my php files?
  34. Generate WordPress salt
  35. Vanilla WordPress install, what can/should I put in disable_functions?
  36. Stop wordpress automatically escaping $_POST data
  37. Secure my “add_settings_field” translation?
  38. how can i embed wordpress backend in iframe
  39. Handling nonces for actions from guests to logged-in users
  40. WordPress Logout Only If User Click Logout or If User Delete Browser History
  41. Can I force a password change?
  42. wp_insert_post disable HTML filter
  43. What is pclzip.lib.php file that wordfence think it’s a malicious code
  44. How to disable XML-RPC from Linux command-line in a total way?
  45. How to remove javascript malware in wordpress site [closed]
  46. Completely remove the author url
  47. Securing my WordPress Files and Directories
  48. Restricting access to content
  49. About WordPress site security
  50. Single sign-on: wp_authenticate_user vs wp_authenticate
  51. How to allow internal links using wp_kses filtration
  52. hSite has no css on mobile [closed]
  53. How does Cross Site Scripting (XSS) work exactly? [closed]
  54. How does the “authentication unique keys and salts” feature work?
  55. vs WordPress Security
  56. esc_html__ security : what for in this example?
  57. Using HTACCESS for Secret Access
  58. Definitive wordpress directory ownership and permissions on linux
  59. Dangers to allowing Access-Control-Allow-Origin: * for Feeds only?
  60. wordpress website host price and security [closed]
  61. Are there security risks in working directly in the themes folder that builds into a theme folder?
  62. Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?
  63. Hack-Proof OR Security in WordPress — is it real?
  64. Secure WordPress: Change admin
  65. Changing the default header name
  66. how much information can we hide when using wordpress cms?
  67. Wordfence detects change in wp-admin/includes/upgrade.php
  68. Basic password protection without using users and roles
  69. System setting changed by system user
  70. Does meta-data need to be sanitized?
  71. 404/500 error on content images if Referer header is from another domain [closed]
  72. Are SVG image files safe to upload? Why WP defines them as a security risk? [duplicate]
  73. Security issue with ‘paged’ and ‘posts_per_page’ parameters taken directly from a POST request?
  74. How to prevent to direct access of my custom plugin folder/files
  75. Checking for origin of a xmlrpc request
  76. RESTRICT EDIT of PHP files?
  77. wp-content – permissions for files/folders created by apache
  78. How can I restrict access to specific parts of a page, not just the page itself?
  79. User generated content and security
  80. Monitor wordpress all external calls
  81. Is it safe to use the basic administration with reduced rights for private member space
  82. Securing WordPress running on Azure platform
  83. Spam Registrations
  84. How can I have more confidence that WP plugins aren’t getting and storing user data?
  85. Standard Method for Securing a WordPress Site
  86. wordpress security (only one part of the site)
  87. Avoid ‘uploads’ 777 permissions: Potential threat or clean solution?
  88. Any way to disable /wp-login.php redirecting to the site folder?
  89. Folder Permissions + Security Concerns
  90. Malware/Permission bug removal?
  91. Step by Step Instructions for Making Media/Uploads Private to Only Logged-In Users
  92. Secure a WordPress website in 2019: one plugin or a combinations of them?
  93. What are the different types of firewall protections available for a WordPress website?
  94. Run a security scan on WordPress site that has .htaccess password [closed]
  95. Is this a WordPress security bug?
  96. Competitor is somehow accessing MetaData on a hidden WordPress site
  97. I am under DDoS. What can I do?
  98. SSH keypair generation: RSA or DSA?
  99. How do I protect my company from my IT guy? [closed]
  100. Does changing default port number actually increase security? [closed]