Protecting Against Malicious Logins

This is not a well visited site, (I don’t mind – it’s just a hobby).  But….

I first got a warning when I got a message from this site about an attempt to change the password, and it wasn’t me.  Looking at my webstats for October I found that the three most popular url were:-

So, basically for every person who views a legitimate post I was getting 50 attempts to log in – probably by bots. Fortunately I had a very strong password so none were successful. 

I installed an app called Limit Login attempts to see if I could curtail this.  The app gives 1000 “referrals” in the free option, which is 1000 login attempts.  The limit was hit in three days.

I found that the login name used was either my real admin name, or my posting name.  I was surprised by the admin name, as I thought I did not have it on my site anywhere, but when I looked at the code, there it was.

So I installed an app called Edit Author Slug. This kept my Admin name out of the code.  But the bots already had my admin name so I changed it to a name I had never used before. So the bots would not get in. But they would still try, and Limit login attempts would still class these as referrals.

The bots crawl the web looking for url’s called wp-login or wp-admin.  Now these can’t just be simply renamed as the names are used in the WordPress code, but an app called WPS Hide Login takes care of that.  I installed this, renamed them and added the bookmark to my personal bookmarks.

After that, The limit login attempts app recorded only my log ins. It had been useful, but was not serving any purpose now so I deleted it.

So, to sum up:-

• A bot will have great difficulty finding my login page
• If it does find it it won’t know my login name
• If it does find that, it still has a very strong password to crack.

I think I’m safe for a while.

I hope someone finds this useful.

Works for me.