Solved

How to Protect WordPress from Attacks with .htaccess plugin?

Posted on 2014-02-23
3
372 Views
Last Modified: 2014-03-14
Some of my wordpress sites have been attacked by brute-force attacks. The hosting company put in an .htaccess file and limited access to the wp-login.php file to only specific IP addresses.

I was previously using a plugin called "limit login attempts", but this plugin still results in server overload during an attack.

Question: Are there plugins available today that will EASILY modify the .htaccess files so that only specified IP addresses will have access to the admin panel? I have several WordPress sites that I either administer directly for my clients, or my clients assume that I will keep them protected while they administer the site, so I want to keep this as easy as possible - both for me and the client.

Thank you.
0
Comment
Question by:Lev Seltzer
  • 2
3 Comments
 
LVL 70

Accepted Solution

by:
Jason C. Levine earned 500 total points
ID: 39880827
Both WordFence and Better WP Security can do it, but you should test that.  If you subscribe to Sucuri then you also get access to their plugin for WordPress and it will also lock down the admin.

One other thing to consider is moving the targeted sites to a more security-conscious host...
0
 

Author Comment

by:Lev Seltzer
ID: 39915778
I use secure paid version for a different website, but the free version does not seem to have this option. It may be that there are no programs that directly modify the .htaccess file, which is what I need. Otherwise, the robot will still waste the server's time while the lookup is made to determine that the IP is not accepted.
0
 
LVL 70

Assisted Solution

by:Jason C. Levine
Jason C. Levine earned 500 total points
ID: 39916618
Again, don't know for sure if a plugin will do this in the exact way you want.  The actual changes are simple enough:

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^123\.123\.123\.121$
RewriteCond %{REMOTE_ADDR} !^123\.123\.123\.122$
RewriteCond %{REMOTE_ADDR} !^123\.123\.123\.123$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule> 

Open in new window

0

Featured Post

Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

Join & Write a Comment

Suggested Solutions

WordPress has made it easy to create scalable sites based on their powerful CMS, but as great as WordPress is, there are some SEO issues that haven’t been addressed out of the box.  Fortunately these problems can be solved with a few plugins.  The f…
I annotated my article on ransomware somewhat extensively, but I keep adding new references and wanted to put a link to the reference library.  Despite all the reference tools I have on hand, it was not easy to find a way to do this easily. I finall…
The purpose of this video is to demonstrate how to manually back up a WordPress Database. This will be demonstrated using a Windows 8 PC. The Host used will be IPage.com Log into your Hosting account. IPage will be used for demonstration : Locat…
The purpose of this video is to demonstrate how to Import and export files in WordPress. This will be demonstrated using a Windows 8 PC. Go to your WordPress login page. This will look like the following: mywebsite.com/wp-login.php : Click on Too…

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now