Solved

How to Protect WordPress from Attacks with .htaccess plugin?

Posted on 2014-02-23
3
375 Views
Last Modified: 2014-03-14
Some of my wordpress sites have been attacked by brute-force attacks. The hosting company put in an .htaccess file and limited access to the wp-login.php file to only specific IP addresses.

I was previously using a plugin called "limit login attempts", but this plugin still results in server overload during an attack.

Question: Are there plugins available today that will EASILY modify the .htaccess files so that only specified IP addresses will have access to the admin panel? I have several WordPress sites that I either administer directly for my clients, or my clients assume that I will keep them protected while they administer the site, so I want to keep this as easy as possible - both for me and the client.

Thank you.
0
Comment
Question by:Lev Seltzer
  • 2
3 Comments
 
LVL 70

Accepted Solution

by:
Jason C. Levine earned 500 total points
ID: 39880827
Both WordFence and Better WP Security can do it, but you should test that.  If you subscribe to Sucuri then you also get access to their plugin for WordPress and it will also lock down the admin.

One other thing to consider is moving the targeted sites to a more security-conscious host...
0
 

Author Comment

by:Lev Seltzer
ID: 39915778
I use secure paid version for a different website, but the free version does not seem to have this option. It may be that there are no programs that directly modify the .htaccess file, which is what I need. Otherwise, the robot will still waste the server's time while the lookup is made to determine that the IP is not accepted.
0
 
LVL 70

Assisted Solution

by:Jason C. Levine
Jason C. Levine earned 500 total points
ID: 39916618
Again, don't know for sure if a plugin will do this in the exact way you want.  The actual changes are simple enough:

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^123\.123\.123\.121$
RewriteCond %{REMOTE_ADDR} !^123\.123\.123\.122$
RewriteCond %{REMOTE_ADDR} !^123\.123\.123\.123$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule> 

Open in new window

0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Do you think that WordPress is just for blogs?  Think again!  WordPress is really a fantastic all around platform that you can use to develop websites on.  Integrated into its basic functionality is the ability to create pages using your choice of a…
In order to have all security and back ups taken care of, WordPress users can sign up for services with WP Engine.
The purpose of this video is to demonstrate how to manually back up a WordPress Database. This will be demonstrated using a Windows 8 PC. The Host used will be IPage.com Log into your Hosting account. IPage will be used for demonstration : Locat…
This video teaches users how to migrate an existing Wordpress website to a new domain.

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question