Definition of the problem

In this article there will be elements of brute force on web sites that are created inside of wordpress. Facts which indicate that web site is compromised will be shown throught article, also it will be explained how to protect yourselfe against brute force.

Introduction

Web site which are we using as an example is our client and it will not be named.

Problem analysis

The easiest way to detect brute force on web site is throught IT security. The trick is that there is an option settings inside IT security, throught which you can get notifications if someone is trying to get into your site. Only thing that is required is to write your e-mail in textbox bellow.

If this option is not included, it is difficult to notice that someone is trying to compromised your website, as long as your site does not collapse or somethig like that.

Mainly the lack of free space on hosting provider is the reason for some web site to collapse and accumulation of new data leads to such situations. Primarily to the lack of space on the hosting provider leads the accumulation of logs.

We are talking about huge amounts of an attempts to logging on to the admin section of WordPress, and a constant lockout of an admin section of the page.

Examples of logs after intrusion attempts on the website

The reason that lockout occurs is because the user name can be easily learned by using their ID’s. Hacker randomly enteres different values of IDs until it reaches the user names. The most common is ID number 1.

Solution to the problem

In order to ensure against further attacks, it is necessary to implement a part of the code in the .htaccess.

RewriteCond %{REQUEST_URI} !^/wp-admin [NC]
RewriteCond %{QUERY_STRING} author=\d
RewriteRule ^ /? [L,R=301]

This code will prevent hackers from reaching the user names. In fact if hacker already used existing user names, it is necessary to change them. User names can be changed in phpMyAdmin under option users. It is only necessary to change user_login but not nicename. Also it is preferable not to have too many user names.