News for hackers. Stuff that matters.

A comment on My First 10 Minutes on a Server. Parent comment

Re:My First 10 Minutes on a Server by treerunner on Wednesday June 15, 2016 @01:10PM (#11910559)
I run a web server with some 50+ Wordpress installs on it. You better believe Fail2Ban is necessary. Without it all resources would be consumed by brute force attacks. If someone knows of a better way I would like to hear about it.
[ Parent | on HN ]
Re:My First 10 Minutes on a Server by snowwrestler on Wednesday June 15, 2016 @06:21PM (#11912598)
We use the WordFence module to block brute force attacks, seems to work fine.

I cannot believe that Wordpress still ships without basic rate limiting on its login form.

[ Parent | on HN ]
Re:My First 10 Minutes on a Server by falcolas on Wednesday June 15, 2016 @02:03PM (#11910881)
In my experience, better to let a webserver handle stopping bad traffic by whitelisting WordPress endpoints.

Parsing a url and returning 404 from nginx is cheap and scalable, and allows through legitimate traffic that may be sharing an IP (such as TOR).

[ Parent | on HN ]