I had a client who had a security plugin installed and they were getting constant alert notifications about hack attempts. Thousands of login retries, even though there was brute-force protection. The attempts would come from a whole botnet of IP addresses to disguise that they were part of one attack.

On top of the security plugin, I added an .htaccess rule to only allow access to the admin login and the entire wp-admin subfolder from within their office. They have a static IP and were OK with only having access from within the office so this worked well for them. This pretty much ended all of the attacks. I probably wouldn't rely on this as the only protection, but it definitely has been a great piece of their overall security plan. The code to do that is here:

https://gist.github.com/jasonhinkle/966aee379b170f365e6f

Another approach is to setup a small VPN that also gets access, though it's not as cost effective for smaller organizations.

I'm curious, what security tools did you have in place that were failing to stop the attacks?

Ironically I can't login to their site from my current IP to see what security plugin they are using!

It was stopping the attacks - it was just that the attacker would try 10 password attempts, then get blocked by the plugin and trigger the alert message. Then the attacker would switch IPs and try 10 more. One morning they had gotten a ton of messages and I found about 250k login attempts in the security logs. So the plugin was doing it's job, but it's better now that the attacks don't even make it that far. In fact you can't even hit a page within the wp-admin folder which is nice in case some type of zero-day exploit surfaces on a file within that area.

Sounds like WordFence. Email notifications are configurable. Turning off most of them is advisable. I've had trouble with users with nominally static IP addresses changing with sufficient frequency to be too much of an annoyance to stay with IP whitelist. Limiting the failed login attempts and maxing out the lockout period cuts down on a lot of the bot activity.

Doesn't that break admin-ajax.php access? It sits behind /wp-admin/. WordPress recommends allowing access when using IP whitelists.

Apache:

  # Allow access to wp-admin/admin-ajax.php
  <Files admin-ajax.php>
      Order allow,deny
      Allow from all
      Satisfy any
  </Files>

Nginx:

  location /wp-admin/admin-ajax.php {
    allow all;
  }

Ah, interesting. I guess their theme didn't use any ajax features. But, to be safe I updated my gist to exclude that file.

No one security solution is enough. While I also like Sucuri, it's Malware scanner tool missed a handful of infections on a recent clean up job. Microsoft Security (or whatever they're calling it now) actually found more (once I downloaded the site's files via FTP)

Moral of the story, don't rely on just a plugin, or a tutorial for your WP security.

Hey @josefresco

Do you have any samples? One of the biggest reasons for this is if it's endpoint malware, versus website malware. Two very different things as you might know. Regardless, would love some samples if you any.

Tony

I do have a recent example - worked out the issues with WPEngine, but it took quite a few scans. I believe they work with you, so you're probably already aware. Prior to being hosted with WPE, we used the Sucuri plugin but all scans were clean.

(going to give context for his ask + big up @perezbox here -- he's the CEO of the awesome Sucuri)

@perezbox - you might want to mention that in your HN Profile. :)

You can have a look at WordFence as well which comes free of charge (and there are paid plans). It does checksumming and guards your login page. https://www.wordfence.com

Can you run it from the outside? Where can I find more on the free offering?

(Obviously asking for my former employer... the haven't understood or fixed the problem yet.)

Ah found it: https://sitecheck.sucuri.net/

At least the pages I looked today at aren't recognized by this external tool. Only green checkmarks, also the "List of scripts included" doesn't see the 2 scripts added dynamically by the injected code in the post.

The Wordpress plugin would probably do a better job.

Hi Sujan

Can we get a list of the domains you scanned that weren't recognized?

Thanks

Done, Celise should have them on your site's chat tool.

Seems like it would be very hard for it to catch everything from the outside. I've seen malware that only presents itself to clients with a Referer from Google or an iPhone user-agent, for example

Yup

What you're referring to is Conditional Malware. We actually do very well with that, but there are no 100% solutions. There are also things that are hard, like Defacements and environments used for Phishing Lures..

All great points

100%. Although in this case the html posted in the blog post is present on all requests, all the time.

I recently installed Drupal on my new domain / website (it has an .xyz extension) and a certain IP was trying to hit all sorts of WordPress related links.