[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

How to Protect WordPress from Attacks with .htaccess plugin?

Posted on 2014-02-23
3
Medium Priority
?
382 Views
Last Modified: 2014-03-14
Some of my wordpress sites have been attacked by brute-force attacks. The hosting company put in an .htaccess file and limited access to the wp-login.php file to only specific IP addresses.

I was previously using a plugin called "limit login attempts", but this plugin still results in server overload during an attack.

Question: Are there plugins available today that will EASILY modify the .htaccess files so that only specified IP addresses will have access to the admin panel? I have several WordPress sites that I either administer directly for my clients, or my clients assume that I will keep them protected while they administer the site, so I want to keep this as easy as possible - both for me and the client.

Thank you.
0
Comment
Question by:Lev Seltzer
  • 2
3 Comments
 
LVL 70

Accepted Solution

by:
Jason C. Levine earned 2000 total points
ID: 39880827
Both WordFence and Better WP Security can do it, but you should test that.  If you subscribe to Sucuri then you also get access to their plugin for WordPress and it will also lock down the admin.

One other thing to consider is moving the targeted sites to a more security-conscious host...
0
 

Author Comment

by:Lev Seltzer
ID: 39915778
I use secure paid version for a different website, but the free version does not seem to have this option. It may be that there are no programs that directly modify the .htaccess file, which is what I need. Otherwise, the robot will still waste the server's time while the lookup is made to determine that the IP is not accepted.
0
 
LVL 70

Assisted Solution

by:Jason C. Levine
Jason C. Levine earned 2000 total points
ID: 39916618
Again, don't know for sure if a plugin will do this in the exact way you want.  The actual changes are simple enough:

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^123\.123\.123\.121$
RewriteCond %{REMOTE_ADDR} !^123\.123\.123\.122$
RewriteCond %{REMOTE_ADDR} !^123\.123\.123\.123$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule> 

Open in new window

0

Featured Post

Prep for the ITIL® Foundation Certification Exam

December’s Course of the Month is now available! Enroll to learn ITIL® Foundation best practices for delivering IT services effectively and efficiently.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you are looking for plug-ins to add functions to your WordPress small business web site, take some time to read though this comprehensive list.  These are all the plugins I use for my customers WordPress web sites, as well as my own.  Be sure to …
WordPress is constantly evolving, and with each evolution appears to get better and better.  One of the big drawbacks prior to version 3 was that there was no way to be able to set up a custom menu from the backend. The Old Way Adding menus is…
The purpose of this video is to demonstrate how to add AdSense Ads to a WordPress Website, and how to set up WordPress to automatically place Ads in Sidebars. This will be demonstrated using a Windows 8 PC. Log into your AdSense account. : Cli…
The purpose of this video is to demonstrate how to update a WordPress Site’s version. WordPress releases new versions of its software frequently and it is important to update frequently in order to keep your site secure, and to get new WordPress…

872 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question