{"id":816,"date":"2013-04-12T11:52:06","date_gmt":"2013-04-12T10:52:06","guid":{"rendered":"http:\/\/blogs.silicontechnix.com\/?p=816"},"modified":"2013-04-16T09:18:54","modified_gmt":"2013-04-16T08:18:54","slug":"prevent-wordpress-loginbrute-force-attack","status":"publish","type":"post","link":"https:\/\/blogs.silicontechnix.com\/?p=816","title":{"rendered":"Prevent WordPress Login\/Brute Force Attack"},"content":{"rendered":"<p>&nbsp;<\/p>\n<p>There is a worldwide, highly-distributed WordPress attack that is ongoing on most of the WordPress powered blogs.<\/p>\n<p>The following steps can be used to secure (by password protection) <code>wp-login.php<\/code> for all WordPress sites in your cPanel account:<br \/>\nHow to Password Protect the wp-login.php File<br \/>\nThere are two (2) steps in accomplishing this. First you need to define a password in the <code>.wpadmin<\/code> file, and then you activate the security in the <code>.htaccess<\/code> file.<!--more--><\/p>\n<p><strong>Step 1: Create the Password File<\/strong><br \/>\nCreate a file named <code>.wpadmin<\/code> and place it in your home directory, where visitors can&#8217;t access it. (Please note there is a period preceding the wpadmin in that file name.) The following example is for cPanel. Plesk would require placing the file in <code>\/var\/www\/vhosts<\/code> or <code>\/var\/www\/vhosts\/domain<\/code>.<\/p>\n<p>EXAMPLE: <code>\/home\/username\/.wpadmin<\/code> (where &#8220;username&#8221; is the cPanel username for the account.)<\/p>\n<p>Put the username and encrypted password inside the <code>.wpadmin<\/code> file, using the format <code>username:encryptedpassword<\/code><\/p>\n<p>EXAMPLE: <code>silicon:n5MfEoHOIQkKg<\/code> (where &#8220;silicon&#8221; is a username of your choice, and the password shown is encrypted.)<\/p>\n<p><strong>Option A: Generate Password File &amp; Uploading Via File Manager<\/strong><br \/>\nOne way to do this is to generate the file using the website linked below, and then upload it to your site via FTP or File Manager. In the directions below, we will use File Manager, but you could use FTP instead, for those of you familiar with FTP.<\/p>\n<ol>\n<li>Visit: <a href=\"http:\/\/www.htaccesstools.com\/htpasswd-generator\/\" target=\"_blank\">http:\/\/www.htaccesstools.com\/htpasswd-generator\/<\/a><\/li>\n<li>Use the form to create the username and password.<\/li>\n<li>Login to cPanel in another window.<\/li>\n<li>Click on File Manager<\/li>\n<li>Select &#8220;Home Directory&#8221;<\/li>\n<li>Check &#8220;Show Hidden Files (dotfiles)&#8221; if not already checked.<\/li>\n<li>Click on the &#8220;Go&#8221; button.<\/li>\n<li>Look for a <code>.wpadmin<\/code> file.\n<ul>\n<li>If one exists, right click on it and select &#8220;Code Edit&#8221; to open the editor. Click on the Edit button to edit the file.<\/li>\n<li>If one does not exist, click on &#8220;New File&#8221; at the top of the page, and specify the name as <code>.wpadmin<\/code> (with the dot at the front) and click on the &#8220;Create New File&#8221; button.<\/li>\n<\/ul>\n<\/li>\n<li>Paste the code provided from the website in step 2.<\/li>\n<li>Click on the &#8220;Save Changes&#8221; button when complete.<\/li>\n<li>You can &#8220;Close&#8221; the file when finished.<\/li>\n<\/ol>\n<p><strong>Option B: Creating the Password File via SSH \/ Command Line<\/strong><br \/>\nTo create the encrypted password you will need to use a utility such as the command-line program htpasswd. More detailed technical information about htpasswd can be found at <a href=\"http:\/\/httpd.apache.org\/docs\/current\/programs\/htpasswd.html\" target=\"_blank\">http:\/\/httpd.apache.org\/docs\/current\/programs\/htpasswd.html<\/a>.<\/p>\n<p>An example would be to do this:<\/p>\n<pre class=\"brush:bash\">htpasswd -c \/home\/username\/.wpadmin silicon<\/pre>\n<p>You would then be prompted to enter the password you wish to use for the username &#8220;silicon&#8221; in order to access the wp-login page. You can then log into the wp-admin interface as you normally would. There are many other online tools that can be used to convert standard passwords to encrypted for this purpose.<\/p>\n<p><strong>Step 2: Update the .htaccess File<\/strong><br \/>\nAll domains under the home directory will share the common <code>.wpadmin<\/code> file, and that previous command creates the <code>\/home\/username\/.wpadmin<\/code> file due to the -c. The last step is to place the following code in the<code> \/home\/username\/.htaccess<\/code> file:<\/p>\n<pre class=\"brush:bash\">ErrorDocument 401 \"Unauthorized Access\"\r\nErrorDocument 403 \"Forbidden\"\r\n&lt;FilesMatch \"wp-login.php\"&gt;\r\nAuthName \"Authorized Only\"\r\nAuthType Basic\r\nAuthUserFile \/home\/username\/.wpadmin\r\nrequire valid-user\r\n&lt;\/FilesMatch&gt;<\/pre>\n<div id=\"divLookup\" style=\"z-index: 10000; border: none; ;top: 860px; left: 284px; right: auto; bottom: auto;\"><img decoding=\"async\" id=\"imgLookForw\" style=\"padding-left: 5px;\" alt=\"\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8\/9hAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAIGNIUk0AAHolAACAgwAA+f8AAIDpAAB1MAAA6mAAADqYAAAXb5JfxUYAAAJJSURBVHjapJNdSJNRGMd\/Z3u3OTXXhx8xjRLDFWIk0jAk6WYYfaAZSUWGZkFdRNRFYAYFXhkI2gpKqISC1IsIUiKIchUEUQiuj4uiMT8m0wbNr+n2vu\/p4l2K3Yn\/m3Pg8Pye8\/wf\/kJKyWokACuQnjxXojgwowCOwPW2iS37y3k0bOfJwwHmYzFePK5n7Oxl0FRyH9zicGM3CZOFBhccypMox2tJdWZnK0Bay\/AGmr+McmJvKUXbaul79hmTzYJ9x3bQdEw2C2V7XOzLUdmVZ2PWvZvm1lcAaQpg\/vY9xL2NRdRMvqHUlYmzoRw9oREPjICqoic0qtIiFGVmECp20+kd4IPPD2AWQMFMcOSnxWZDavqyIcfOXARVJ7fLu9w4s4nEwgLpmzdtVQB+HW0kNcOBFo3Cv6VICWYTSEmw6hSYBOjGo7LOwdz0lHEHiMVimCciaNEpRLIWqSMUxWCpKgiBEAIJqI4M5tLtS4Cs++3kZGUlK5cUcFciEwkKBl\/\/t3xBeHIS3KWYAEo87biruxiKWkh568N\/447RWZdI3fAlMG8l5Z2PT00deOq6KfHcBjAA+YVO+p6eo8zXy\/P+r9R9tCcbCQQCgIMHOuh3llFx2kNn\/jjFhWuXAN6rFay\/66XtZZjG9zrh0KjxVasCNgsAs9N\/OHnkJq0\/HLjOH+NadmjRg7jW00tnWOPKQGRxzEH\/EOM7XUhNI+of4nckCEDThRaCl2qor66E\/p64ABxALrBmhVmYBsYEYE4GybxCgAbExWrj\/HcACIPUyGtYcDcAAAAASUVORK5CYII=\" border=\"0\" \/><img decoding=\"async\" id=\"imgLookBack\" style=\"padding-left: 5px;\" alt=\"\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8\/9hAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAIGNIUk0AAHolAACAgwAA+f8AAIDpAAB1MAAA6mAAADqYAAAXb5JfxUYAAAHeSURBVHjapJM9axRRFIafO1+767qJURyLFYKglSBROxVCrITkH1iIgr9AsLHRRrARFStBg4KViJWFRrTQdoKtgokRN1n2g5l1152ZuzP3WuzsMiuCCXmLezgH7sPL4T1Ca81uJAAH2JvVnUgCPQuY1lo3RtPz1y6AViCM\/xI+3H3jWkA5P5w7egK0BiGGVSkwzZxlgUbjfVkFKFuAmQesb30HnQICW1jMVo+wtrmOUimkCgQcmHGRyQDANADSNB0D\/F6A3+3gBy2Wzi1iWzbtdp3O7y7zpxeYP7WAHzSJpQTAAJBZMwYETcqVfZw9foZPnz\/i93\/h9wL6UUg\/Cml1moRxCIAFEMcxpVIJgG+1NQgj3INV3JlD1NtbbLZrYDrceXYbJWBqaj\/28OvQQRRFYwdKK5RQbDR+UiwUubR4BdVLUWHIQMYApFoRRTkHE4Bs6z82vnLvxX1uXLzOrHuYpyvPqZQq7CkUeeu9Q4by3wAxep0CNx\/fotaqc3XpMiePzbGy+p4HLx8yiCLiOJncwUiOXQCVgmGCViy\/esTy6ycIy0SHMTgWmBZS9scAmSQJnucB0G10huExcknUmUMhgHgizgKYBqpAZYe30AVqIkui83cit6EUkGK35\/xnAEun1teq1Z2VAAAAAElFTkSuQmCC\" border=\"0\" \/><\/div>\n","protected":false},"excerpt":{"rendered":"<p>&nbsp; There is a worldwide, highly-distributed WordPress attack that is ongoing on most of the WordPress powered blogs. The following steps can be used to secure (by password protection) wp-login.php for all WordPress sites in your cPanel account: How to Password Protect the wp-login.php File There are two (2) steps in accomplishing this. First you [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":822,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_s2mail":"no","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[17,95],"tags":[72,364,56,366,365,76,9,363,368,367],"class_list":["post-816","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-system-administration","tag-attack","tag-brute-force","tag-hacking","tag-htaccess","tag-login","tag-password","tag-wordpress","tag-wp","tag-wp-login","tag-wpadmin"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/blogs.silicontechnix.com\/wp-content\/uploads\/2013\/04\/wp.jpg","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p12j6H-da","_links":{"self":[{"href":"https:\/\/blogs.silicontechnix.com\/index.php?rest_route=\/wp\/v2\/posts\/816","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.silicontechnix.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.silicontechnix.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.silicontechnix.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.silicontechnix.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=816"}],"version-history":[{"count":9,"href":"https:\/\/blogs.silicontechnix.com\/index.php?rest_route=\/wp\/v2\/posts\/816\/revisions"}],"predecessor-version":[{"id":899,"href":"https:\/\/blogs.silicontechnix.com\/index.php?rest_route=\/wp\/v2\/posts\/816\/revisions\/899"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blogs.silicontechnix.com\/index.php?rest_route=\/wp\/v2\/media\/822"}],"wp:attachment":[{"href":"https:\/\/blogs.silicontechnix.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=816"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.silicontechnix.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=816"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.silicontechnix.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=816"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}