4 ms·
I've added a /wp-login.php and friends that firewall-blocks the IP of the requester for a week. It greatly cuts down the bot noise.
by hyperman1 2y ago
I've added a /wp-login.php and friends that firewall-blocks the IP of the requester for a week. It greatly cuts down the bot noise.
- immibis 2y agoMy competing site can have <img src="https://yourdomain/wp-login.php https://yourdomain/wp-login.php"> and customers won't be able to view your site after that. Thanks for the free customers!
- sweetjuly 2y agoYep :) The real trick is to not be vulnerable to known issues, and then mitigate post-compromise like crazy on the off chance you get patch gapped or (very unlikely) zero dayed. Blocking IP addresses is extremely silly, especially in an IPv6 world where attacker can easily get access to gigantic numbers of addresses in hard to identify ways (there's no source of truth for what IPv6 range corresponds to one blockable "customer". Some get /56s, others get /48s, etc.). It's security theater which may well just break your service for real users.
- Beijinger 2y agoCan you post the script? Obviously I assume you don't run wp. I think wordfence does something similiar.
- DEADMINCE 2y agoIt's probably just an nginx fail2ban jail or something that looks for the wp pattern.