Viewing passwords is not possible, because they are not stored anywhere. WordPress stores just the hash of the password, not the password itself. When a user sends her password to authenticate herself, WordPress creates a hash of the sent password and compares that to the stored hash. You should not try to store the passwords … Read more
I would consider it somewhat safe since that’s where your database connection information is also stored. One could easily ruin your website by deleting your whole database if they had access to that file. There are a couple of things you can do to increase security: Move the wp-config file one level outside the root. … Read more
You can use login_errors filter for changing the custom error message Please have a look at Change login error messages
I understand this isn’t exactly what you’re looking for but these hackers are most likely bots and redirecting them won’t matter at all. I suppose you could modify the below code if you reallllly wanted to but this will redirect anybody looking for an author back to your homepage. RewriteCond %{REQUEST_URI} ^/$ RewriteCond %{QUERY_STRING} ^/?author=([0-9]*) … Read more
The functions that generate, validate and clear auth cookies are all pluggable (meaning you can write your own versions of them). Just note that some of them may need to return something specific (like the user ID). wp_generate_auth_cookie() (generates your cookies) wp_set_auth_cookie (actually sets the cookies) wp_validate_auth_cookie() (validates your cookies) wp_parse_auth_cookie (parses an auth cookie, … Read more
You should not. Nonce is used to protect against cross site request forgery attacks (CSRF) in which another aite tries to trick you into submitting a form to your site which will perform some hostile action. Nonces are unique value that can be generated only by a specific site at a specific time and therefor … Read more
Brute force attacks seem to the be most common vulnerability on WP installs Brute force attacks are not WordPress vulnerability. They are password vulnerability, if bad passwords are used. They are common, but if they are “the most common” in occurrences and, more importantly, breaches is questionable. rate limiting ought to be relatively easy to … Read more
Rather than blacklist logins, why not whitelist your own IP (example 12.345.67.891 below; or a range) for wp-login.php and in wp-admin for logins and administration? (No plugin needed). A whitelist will block everyone else except you from login. See http://httpd.apache.org/docs/2.4/howto/access.html in the .htaccess in the wp-admin folder: Options All -Indexes order deny,allow deny from all … Read more
You can use this code in your functions.php to restrict users below admin level from changing their passwords: if ( is_admin() ) { add_action( ‘init’, ‘disable_password_fields’, 10 ); } function disable_password_fields() { if ( ! current_user_can( ‘activate_plugins’ ) ) { $show_password_fields = add_filter( ‘show_password_fields’, ‘__return_false’ ); } } The admin should probably register each user … Read more
No, the requests will still happen, even if it results in a 404. If you keep logging, you’ll also notice attempts to log in to Drupal, Joomla, and other major CMS, including server exploits for IIS Apache and Nginx This is because they’re automated opportunistic requests, they’re not actually looking at your site, they’re only … Read more