Friday 12 April 2013

WP 'brute force attacks'

If you have a Wordpress site, then try to login to the admin page and see if you get this error:
'Wordpress administrator area access disabled temporarily due to widespread brute force attacks'.
If so, first off, this is a result of a hack attempt - your site remains intact for now, but this will stop you updating or (probably more to the point,) deleting unwanted comments and track-backs. This is definitely NOT a Wordpress Admin warning, it is a hack, but don't worry loads of us have been hacked..... I did a quick search and found a fix very quickly right here:


Note that you will need FTP access or file management to edit your HTACCESS file and that you need to copy all of the following:

 ~ "^wp-login.php"> 
Order deny,allow 
Deny from all 

Allow from x.x.x.x 
..into the text of the file, the file may look like this (after the edit):

# BEGIN WordPress

Order deny,allow
Deny from all

Allow from 99.999.99.999


RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]


# END WordPress

Just change the 99.999.99.999 to your IP address, and if you don't know it , click the folowing link to find out:

I know little about WP, but this fix worked for me.. I am also guesing that you could 'allow' further IP addresses by adding them line by line. 'Allow from 88.888.88.888' etc...

Anyway, I though I would post this in case there are others looking for a fix.

No comments: