5 ms·

When you set up a new WordPress site, or you can do this for an existing site as well, create a new user and give this new user the Administrator role. Then log

by pan69 12y ago

When you set up a new WordPress site, or you can do this for an existing site as well, create a new user and give this new user the Administrator role. Then log out and log in as the new admin user. Now, don't delete the original "admin" user but instead change the password to something super strong and give the user no role. This way, bots will think that the admin user exists and will try to brute force the super strong password you gave it, which obviously will be futile.

regecks 12y ago
Unfortunately this is of limited helpfulness. At my job (small web host), many of the WordPress brute force attacks we see across our shared hosting fleet use the '?author=\d+' trick in WordPress to find the usernames of admin-like users before starting the actual attack. Totally idiotic of WordPress to reveal usernames this way. We have moderate success in slowing/blocking these attacks using a WAF such as mod_security (after a certain number of HTTP 200 responses on wp-login, aka login failed, block the IP). On the bright side, our load averages went down a non-trivial amount once we introduced these rules (a few customers would get effectively and inadvertently DoS'd by these brute forces LOL)
- pan69 12y ago
  Hmm. The your ?author=\d+ trick doesn't seem to do anything on any of my WordPress websites, just get a 404.
  - gondo 12y ago
    the \d+ is regular expression that means, use: ?author=1 ?author=2 ?author=3 ?author=4 ...
    - regecks 12y ago
      Right. e.g. http://en.blog.wordpress.com/?author=1 http://en.blog.wordpress.com/?author=1 http://en.blog.wordpress.com/?author=2 http://en.blog.wordpress.com/?author=2 Pointless information disclosure
ValentineC 12y ago
I usually change the 'admin' username to something different, so the dumb bots that try to bruteforce their way in would give up altogether. I'm not sure about WordPress revealing whether it's the username or password that's incorrect though. It's a compromise between security and UX that should be left to the admin (of course, there are plugins to remedy this).

by pan69 12y ago

regecks 12y ago

Unfortunately this is of limited helpfulness. At my job (small web host), many of the WordPress brute force attacks we see across our shared hosting fleet use the '?author=\d+' trick in WordPress to find the usernames of admin-like users before starting the actual attack. Totally idiotic of WordPress to reveal usernames this way. We have moderate success in slowing/blocking these attacks using a WAF such as mod_security (after a certain number of HTTP 200 responses on wp-login, aka login failed, block the IP). On the bright side, our load averages went down a non-trivial amount once we introduced these rules (a few customers would get effectively and inadvertently DoS'd by these brute forces LOL)

pan69 12y ago
Hmm. The your ?author=\d+ trick doesn't seem to do anything on any of my WordPress websites, just get a 404.
- gondo 12y ago
  the \d+ is regular expression that means, use: ?author=1 ?author=2 ?author=3 ?author=4 ...
  - regecks 12y ago
    Right. e.g. http://en.blog.wordpress.com/?author=1 http://en.blog.wordpress.com/?author=1 http://en.blog.wordpress.com/?author=2 http://en.blog.wordpress.com/?author=2 Pointless information disclosure

ValentineC 12y ago

I usually change the 'admin' username to something different, so the dumb bots that try to bruteforce their way in would give up altogether. I'm not sure about WordPress revealing whether it's the username or password that's incorrect though. It's a compromise between security and UX that should be left to the admin (of course, there are plugins to remedy this).