[wp-edu] About to give up

[Tim Owens]

In a lot of cases we see traffic taking the form of brute force login
attempts both on wp-login.php and xmlrpc.php. Handling this at the plugin
level is harder than at the server level because any plugin is going to
have to load properties of WordPress and make database calls to read
anything about the user and IP-based blocking is often thwarted by a
distributed attack from many different IP addresses (so individual IPs
might only log in one time but the weight of all attempts across the range
will take down the server).

We've had good experience using Fail2ban on the server (
http://www.fail2ban.org/wiki/index.php/Main_Page) in combination with the
WP-fail2ban plugin (https://wordpress.org/plugins/wp-fail2ban/) which
writes failed login attempts to the auth log. The plugin can deny at the
server level *any* attempt with username admin or administrator which alone
will cut down on 99% of attacks and beyond that can block network ranges
based on the failed attempts of multiple IPs within that range. It's a
really elegant and flexible solution in my opinion.

-----
Tim Owens


On Tue, May 26, 2015 at 3:54 PM, Ryan Kite <rkite at yvcc.edu> wrote:

>   Have you tried WordFence? Free Plugin works great for locking things
> down.
>
>   From: wp-edu on behalf of Joseph Ugoretz
> Reply-To: "Low-traffic list discussing WordPress in education."
> Date: Tuesday, May 26, 2015 at 12:50 PM
> To: "Low-traffic list discussing WordPress in education."
> Subject: Re: [wp-edu] About to give up
>
>   So sorry to hear about this Darcy!
>
>  We’ve kept things up to date and secure for about seven years now, but I
> know you don’t want to hear that!
>
>  I have heard many very good reports about Sucuri
> https://sucuri.net/wordpress-security/wordpress-security-monitoring
>  both for ongoing monitoring and for cleanup once the problem is happening.
>
>  For hosting, I think (especially if you don’t have real support), the
> folks at Reclaim Hosting are going to be a lot better support and
> caretaking.
>
>
>  --
>
> Joseph Ugoretz, PhD
>
> Associate Dean
>
> Teaching, Learning and Technology
>
> Macaulay Honors College
>
> City University of New York
>
> macaulay.cuny.edu
>
> On May 26, 2015 at 3:43:49 PM, Darcy Greene (greened at msu.edu) wrote:
>
>   Hi fellow Wordpress multisite users
>
>  We have been using Wordpress multisite with our School of Journalism
> class sites for the past five years. It seems that we have finally lost the
> battle with plugins and updates. Security is breached, unexplained traffic
> is taking down the servers and nothing is reliable. The competent people
> who did the original install are long gone.
>
>  Have any of you faced similar problems with an old WPMS network? Do you
> have an outside host that keeps things running smoothly? Have you changed
> to a new system?
>
>  Thanks for your feedback.
>
>  Best,
>
>  Darcy
>
>
>
>
>
>
>
>
>
>
>
>
> _______________________________________________
> wp-edu mailing list
> wp-edu at lists.automattic.com
> http://lists.automattic.com/mailman/listinfo/wp-edu
>
> _______________________________________________
> wp-edu mailing list
> wp-edu at lists.automattic.com
> http://lists.automattic.com/mailman/listinfo/wp-edu
>
>
> _______________________________________________
> wp-edu mailing list
> wp-edu at lists.automattic.com
> http://lists.automattic.com/mailman/listinfo/wp-edu
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.automattic.com/pipermail/wp-edu/attachments/20150526/5ac939d5/attachment.html>