{"id":2389,"date":"2015-05-20T10:51:00","date_gmt":"2015-05-20T07:51:00","guid":{"rendered":"http:\/\/dima.fi\/blog\/?p=2389"},"modified":"2026-01-10T22:58:06","modified_gmt":"2026-01-10T20:58:06","slug":"wordpress-brute-force-attack","status":"publish","type":"post","link":"https:\/\/dima.fi\/blog\/wordpress-brute-force-attack\/","title":{"rendered":"Prevent WordPress wp-login.php brute force attack"},"content":{"rendered":"\n

I’m maintaining a lot of WordPress based sites. And almost daily there is some brute force attack on one of them. The target of these attacks is wp-login.php<\/em> file. There is a lot of solutions to protect this file by limiting access to it using a separate password or manually adding allowed IP address. And changing them all the time is not an option for me.<\/p>\n\n\n\n

So how I solved this? By automagisation! \ud83d\ude09
Main point is to modify .htaccess<\/em> file to have access rules like:<\/p>\n\n\n\n

<Files wp-login.php>\n   Order deny,allow\n   Deny from all\n   Allow from 123.123.123.123\n<\/Files><\/code><\/pre>\n\n\n\n
This rule denies access from all and allows from ip 123.123.123.123.<\/p>\n\n\n\n
But we need to change IP automatically wherever we are. My solution is to use a PHP script that checks my current IP and changes it to .htaccess<\/em> file. And by adding a little bit of magic I can access wp-login.php<\/em> with only one click! How?<\/p>\n\n\n\n
Like this:<\/p>\n\n\n\n
  1. I’m opening my-wordpress-site.com\/magical-login.php<\/em> url<\/li>
  2. magical-login.php<\/em> checks my current IP and changes it to the access rule<\/li>
  3. magical-login.php<\/em> redirects me to wp-login.php<\/em>, which now accessible for me<\/li><\/ol>\n\n\n\n
    And of course nobody knows that magical-login.php<\/em> file exists. I can change the filename to whatever I want.<\/p>\n\n\n\n
    You probably want to know what does this magical-login.php<\/em> contain? Here:<\/p>\n\n\n\n
    <?php \n\n\/\/ reading current content from .htaccess\n$ht = fopen(\".htaccess\", \"r\");\n$content = fread($ht, filesize(\".htaccess\"));\nfclose($ht);\n\n\/\/ removing old access rule for wp-login.php file \n$content = preg_replace(\"\/\\<Files wp-login\\.php\\>.*\\<\\\/Files\\>\\s+\/s\",\"\",$content);\n\n\/\/ checking current ip address\nif (!empty($_SERVER['HTTP_CLIENT_IP'])) $ip = $_SERVER['HTTP_CLIENT_IP'];\nelseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];\nelse $ip = $_SERVER['REMOTE_ADDR'];\n\n\/\/ creating new access rule with new ip address\n$rule = <<< rule\n<Files wp-login.php>\n        Order deny,allow\n        Deny from all\n        Allow from $ip\n<\/Files>\n\nrule;\n\n\/\/ writing new .htaccess content\n$ht = fopen(\".htaccess\", \"w\");\nfwrite($ht, $rule.$content);\nfclose($ht);\n\n\/\/ redirecting to wp-login.php\nheader('Location: wp-login.php');\n\n?><\/code><\/pre>\n\n\n\n
    Make sure your webserver has write permission to .htaccess<\/em> file.<\/p>\n\n\n\n
    Just drop your PHP file to the same folder with wp-login.php<\/em> and open it with your browser. It will add access rule to the top of .htaccess<\/em> file and you are done. Next time just forget about wp-login.php<\/em> and use the file you have created.<\/p>\n","protected":false},"excerpt":{"rendered":"
    Prevent hackers from brute force attacking Wordpress’ wp-login.php file<\/p>\n","protected":false},"author":1,"featured_media":2431,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/images.unsplash.com\/photo-1563705883268-eb58ab6f505d?ixlib=rb-1.2.1&q=80&fm=jpg&crop=entropy&cs=tinysrgb&w=1080&fit=max&ixid=eyJhcHBfaWQiOjF9","fifu_image_alt":"Prevent WordPress wp-login.php brute force attack","footnotes":""},"categories":[133],"tags":[162,139,134,161],"class_list":["post-2389","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-web-devs","tag-brute-force","tag-dev","tag-web","tag-wordpress","has-thumbnail"],"_links":{"self":[{"href":"https:\/\/dima.fi\/blog\/wp-json\/wp\/v2\/posts\/2389","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dima.fi\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dima.fi\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dima.fi\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dima.fi\/blog\/wp-json\/wp\/v2\/comments?post=2389"}],"version-history":[{"count":2,"href":"https:\/\/dima.fi\/blog\/wp-json\/wp\/v2\/posts\/2389\/revisions"}],"predecessor-version":[{"id":2392,"href":"https:\/\/dima.fi\/blog\/wp-json\/wp\/v2\/posts\/2389\/revisions\/2392"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dima.fi\/blog\/wp-json\/wp\/v2\/media\/2431"}],"wp:attachment":[{"href":"https:\/\/dima.fi\/blog\/wp-json\/wp\/v2\/media?parent=2389"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dima.fi\/blog\/wp-json\/wp\/v2\/categories?post=2389"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dima.fi\/blog\/wp-json\/wp\/v2\/tags?post=2389"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}