brute force on wp-login.php

[mineistaken]

What pisses me off is that my stats (awstats etc) gets messed up by them, there is no way to have accurate stats because more hits are from bots than from actual visitors.
/rant

[signupdamnit]

http://configserver.com/cp/csf.html and ban them manually if you can't use it to automatically ban them. I think there is a setting to do it.

[TrafficRush]

theres a patch for that!

[mineistaken]

theres a patch for that!

If you mean for attacks then I installed wp harden plugin which redirects wp-login.php to home page.

Now I am looking for patch to see accurate awstats. Because now my numbers are inflated by bots and stats are basically useless, no idea how many of those are real visitors, how many bots.

[nico-t]

same here, seems like almost every wordpress site has this. What are those bots trying to accomplish? No way the passes can be cracked. Seems so useless in my opinion.

[Barry-xlovecam]

https://illuminatikarate.com/blog/ex...stats-reports/

It's in the conf file. You can exclude static IP addresses too.

[mineistaken]

https://illuminatikarate.com/blog/ex...stats-reports/

It's in the conf file. You can exclude static IP addresses too.

Very nice, however I have an issue: I installed harden wp plugin so hits to wp-login.php are redirected to home page, meaning that awstats would count them because it won't be backend hit (I assume).
Its either I prevent attacks (by using harden wp) but have compromised awstats or I do not prevnt attacks but fix awstats using this method

[geirlur]

I had the same problem but I've only allowed my IP to access the loginpage and now I get accurate (and disappointing) stats. It was my host who sat it up so don't ask me how

btw for blogs I like to use the jetpack stats rather than awstats, it's real time too..

[d-null]

it's even worse if you are running forums

[PornDiscounts-V]

Ban ip's for unsuccessful logins

[SplatterMaster]

EDIT** Never mind. Looking at the directory structure online wp-login.php is in the root directory.

[Dankasaur]

Use a more advanced statistics program.

[SplatterMaster]

Here's a trick you can try. I haven't tried it but it looks like it should work.

Password protect your admin directory with .htacess and then use .htaccess to filematch that protection to your login.php file.

http://www.inmotionhosting.com/suppo...n-php-attempts

[EnterpriseVpsSolutions]

Only allow access from your static ips to the admin section deny all else.

[Fat Panda]

yup use htaccess to only allow your ip in admin

[fris]

htaccess block everyone from admin, do signups via the front end and disable redirection to admin after signup

[~Ray]

what would that htaccess command look like?

[fris]

what would that htaccess command look like?

Order Deny,Allow
Deny from all
Allow from xx.xx.xx.xx

file placed in wp-admin dir

[fris]

or this

<Files wp-login.php>
Order Deny,Allow
Deny from all
Allow from xx.xx.xx.xx
</Files>

[brassmonkey]

http://wordpress.org/plugins/hc-custom-wp-admin-url/

[BareBacked]

this is a huge pain in the ass

[mineistaken]

Only allow access from your static ips to the admin section deny all else.

Question - does awstats count denied visitors? I mean those would still technically hit the site (and show up on the stats?).

[geirlur]

Question - does awstats count denied visitors? I mean those would still technically hit the site (and show up on the stats?).

Doesn't show up for me

[tahiti]

What pisses me off is that my stats (awstats etc) gets messed up by them, there is no way to have accurate stats because more hits are from bots than from actual visitors.
/rant

10000's of plugin to autoban after x attempts.

[KaliC]

What pisses me off is that my stats (awstats etc) gets messed up by them, there is no way to have accurate stats because more hits are from bots than from actual visitors.
/rant

You can change this file name with no issues.

[Captain Kawaii]

Great thread. Thanks for the experts pitching in. Shit is frustrating.