3 ms·

I think Drupal would be better for government websites.

• yjftsjthsd-h 8y ago
  I think the point was that you get attempts on /wp-admin.php even if you're not running wordpress at all. I mean, my personal blog is a static collection of HTML pages and I still see /wp-admin.php in logs. In fact, I've long wondered whether this isn't a great opportunity; I'd like to make a script that went through logs and got every IP trying to access such a path, and adds those IPs to a blacklist that gets dropped at the firewall. Not even a honeypot (since they try even when there's nothing there at all), but still a way to catch (really stupid) bad actors / compromised systems.
  • tetha 8y ago
    That's called fail2ban, and you're describing a custom filter.
  • hueving 8y ago
    Careful, because of nat that's also a way to ban potential legit users.
    • mcny 8y ago
      I started commenting but I deleted everything half way because I hadn't thought about public WiFi access points. I remember we used to do temporary IP bans on the English Wikipedia if there was too much abuse but it was only for editing. 4chan bans are also for posting afaik. I don't know of a blanket refusal to connect ban for a web server. Would it be ok to ban an entire IP just because someone from that IP has a compromised machine? I remember this argument that if there is obviously malicious traffic coming from an IP address, the right solution is to block traffic at the next stop, usually the ISP supplying Internet access to that connection. Failing that, the back end should disconnect the ISP and failing that, the other peers should disconnect from the malicious peer. But I don't know how practical it is...