Can't Login To Wordpress Cuz of DDoS attacks? Here's one quick fix ..

by kevinlairre

Posted: 11 years ago 16 replies

WEB DESIGN

Hi all,

I am sure most of you who have Wordpress sites have heard of the recent DDoS attacks to Wordpress sites worldwide.

Due to such attacks maybe a lot of people might even have trouble logging in. I know I had trouble because my Hosting service had blocked anyone from logging in to wordpress - even the genuine user(s) !

So I came up with a temporary 'quick fix', it will not solve all your security issues as such but it would certainly help you temporarily bypass the blocked login page and help you login immediately to your wordpress site!

Here's the quickfix:

1) Goto the directory where wordpress is installed and download the wp-login.php file to your computer.

2) Rename the file to wp-confusingname.php or choose any confusing name .php .. (So that no random person finds your login page unnecessarily) ... In this example lets say we name it 'wp-confusingname.php' ...

3) Open the file with notepad or wordpad and use the find and replace option to find the keyword 'wp-login.php' and replace it with 'wp-confusingname.php' (replace it with the confusing name that you chose).

4) After replacing all instances of wp-login.php in the file with the above, save the file and upload it (via ftp) back to the main wordpress directory.

5) to login simply goto the address of this new php file that you uploaded and enter your username and password to login.

When you wish to logout:

(You can make changes to the other php files that run the admin dashboard, but since this is a temporary solution, you can use the method below)

Instead of the usual way to go and click logout , you could right click and copy the logout link address and Paste the address on the browser. After pasting, replace the instance of 'wp-login.php' with 'wp-confusingname.php' (or whatever the confusing name that you chose) and hit the enter key to logout.

When your hosting provider resumes access to let you login normally - simply delete this new php file that you created and resume the previous way you used to login.

#attacks #cuz #ddos #due #fix #login #quick #wordpress

Patrick 11 years ago

playing around with core files is in itself a big "security risk"...
- Thanks
- 1 reply
Signature
Freelance WordPress Developer | Free WordPress Themes | Free WordPress Plugins | Free WordPress Support
{{ DiscussionBoard.errors[7982864].message }}
- kevinlairre 11 years ago
  
  You don't have to delete the original 'wp-login.php' ... This was simply to bypass a blocked login page - by your hosting providing ... By no means does it claim to secure anything.
  
  And I disagree to the fact that the new file would be a 'security risk' or creates a security hole ... but that's just my opinion ... if you think i'm wrong .. please feel free to correct me ...
  
  Thanks
  
  Signature
  >> How To Build PROFIT PULLING Blogs That Make You Money On AUTOPILOT <<
  
  {{ DiscussionBoard.errors[7982879].message }}
RobinInTexas 11 years ago

Messing around with the core files is a bad idea.

Best to install a plugin like Wordfence or Bulletproof security and be done with it.
- Thanks
Signature

Robin

...Even if you're on the right track, you'll get run over if you just set there.
{{ DiscussionBoard.errors[7982900].message }}
Patrick 11 years ago

There is already a Codex for security in Wordpress but no one bothers to read it....

Hardening WordPress « WordPress Codex
- [ 1 ] Thanks
- 1 reply
Signature
Freelance WordPress Developer | Free WordPress Themes | Free WordPress Plugins | Free WordPress Support
{{ DiscussionBoard.errors[7982902].message }}
- kevinlairre 11 years ago
  
  Originally Posted by schwarzes
  
  There is already a Codex for security in Wordpress but no one bothers to read it....
  
  Hardening WordPress « WordPress Codex
  
  Thanks for that - that would certainly help with the security part ... and is a good resource ...
  
  Another idea is to go to -> Patching the Internet in Realtime: Fixing the Current WordPress Brute Force Attack - CloudFlare blog ....
  
  Cloudflare claims that their free account helps protect your blog against the recent form of DDoS attacks ..
  
  Thanks
  
  1 reply
  
  Signature
  >> How To Build PROFIT PULLING Blogs That Make You Money On AUTOPILOT <<
  
  {{ DiscussionBoard.errors[7982925].message }}
  
  squadron 11 years ago
  
  Originally Posted by kevinlairre
  
  Cloudflare claims that their free account helps protect your blog against the recent form of DDoS attacks ..
  
  I love Cloudflare. It saves me about 40% of my bandwidth usage and makes my sites load super-quickly. You can even block entire countries with one click.
  
  Thanks
  
  Signature
  2020 - Another Year of Bitcoin
  
  Wordpress Help
  
  {{ DiscussionBoard.errors[7986219].message }}
kevinlairre 11 years ago

^ But you need to be able to Login first to install the plug - in . The problem I had faced (and maybe other's might be facing - depends on their hosting provider) is the inability to login to wordpress to make any changes whatsoever. So I wrote this to address that particular problem ... and is a temporary fix ..

I however do agree with the fact that you should not do anything stupid with the core files otherwise it could cause problems. (Thus create a backup always!) and please be careful in that aspect too.
- Thanks
Signature
>> How To Build PROFIT PULLING Blogs That Make You Money On AUTOPILOT <<
{{ DiscussionBoard.errors[7982907].message }}

SteveJohnson

11 years ago

Some hosting companies went a little overboard and blocked access to wp-login.php addresses. It may have been warranted, they were getting hammered hard.

What the OP describes will work. It is a temporary fix, and not a 'security problem' in the least. Only the person knowing the new name of the file will be able to access it.

The only 'security' plugins that will have any effectiveness at all in this kind of attack are the ones that use .htaccess file to block repeated login attempts. However, with the number of computers that were used (I've seen estimates of 90,000 or more), your site will still go down just from the overhead of processing the high number of login attempts.

This wasn't (isn't) a 'DDoS' attack in the true sense of the term. That was the end result, but it wasn't the objective. The objective was to gain access to the server via WP backend.

Following the suggestions in the WP Codex for hardening your site will have prevented access, but would have done nothing to keep your site/server from going down under the sheer load of the brute-force attack.

[ 2 ] Thanks
1 reply

Signature

The 2nd Amendment, 1789 - The Original Homeland Security.

Gun control means never having to say, "I missed you."

{{ DiscussionBoard.errors[7983060].message }}

Patrick

11 years ago

Originally Posted by SteveJohnson

k...First of all it was dumb of the hosting companies to block access to that file...There are millions of sites in WP....If your hosting has blocked that file, I would recommend you to change your hosting ! coz that is a really dumb move ( don't get it why people are calling it smart move )

Secondly, I still stand to the line that messing with core files or EVEN creating new ones to mimic the "CORE" files is a BIG security risk !

Thanks
1 reply

Signature

Freelance WordPress Developer | Free WordPress Themes | Free WordPress Plugins | Free WordPress Support

{{ DiscussionBoard.errors[7983636].message }}

kevinlairre

11 years ago

Originally Posted by schwarzes

Some hosting services that got hammered hard - had to block access to that file , since the attackers constantly tried to access that file and that script repeatedly and it was consuming a lot of bandwidth and a lot of resource. You really need to look into the concept of DDoS .. it's very difficult to block it especially when it comes from a range of multiple IP addresses in the tens of thousands ...

I got the idea cause some other hosting solution did the same thing for their wordpress blog customers ... And as i said it's a temporary solution ... so even if it is a 'Big' security risk, it can be undone ...

That being said, I am definitely curious to learn more your point of view on why and how you think mimicking a core file like the above file, is a 'BIG security risk' ?

Thanks
1 reply

Signature

>> How To Build PROFIT PULLING Blogs That Make You Money On AUTOPILOT <<

{{ DiscussionBoard.errors[7984334].message }}

Patrick

11 years ago

Originally Posted by kevinlairre

Some hosting services that got hammered hard - had to block access to that file , since the attackers constantly tried to access that file and that script repeatedly

Ok...if that's the case, then half of the world's WP site should be outdated today ? coz they cannot login to update their sites ? One pays to a hosting company for hosting their website and accessing it whenever they want so that they can update their website. Now if the hosting companies are themselves stopping the customers from accessing what they have paid for, then that's not a good hosting company ? I have several wp sites as well, none of them had problems...hostgator didn't shut down wp-login, nor did bluehost ( i worked on sites hosted on both today )

If a hosting company cannot secure their own services, and give excuses like "DDos" and stuff like that and block access to customer's site, I think they better start paying more for security or stop acting as "secure" hosting companies...

Thanks
1 reply

Signature

Freelance WordPress Developer | Free WordPress Themes | Free WordPress Plugins | Free WordPress Support

{{ DiscussionBoard.errors[7984435].message }}

kevinlairre

11 years ago

Originally Posted by schwarzes

Sure one can blame the hosting sites, cause after all it is what one pays for - fair enough. One can change their hosting service provider too. Maybe even some servers were more heavily attacked, either ways, hosting services could be blamed for it too - for not being secure -that's fair enough.

But that still leaves one question un-answered - the question of how mimicking the above file became a 'big security risk' ?

Thanks

Signature

>> How To Build PROFIT PULLING Blogs That Make You Money On AUTOPILOT <<

{{ DiscussionBoard.errors[7984459].message }}

SteveJohnson

11 years ago

Let me just add one thing - if your WP installs had a strong 8-12 character password with upper- and lower-case letters, numerals, and a punctuation character or two, you had nothing to worry about.

Thanks
1 reply

Signature

The 2nd Amendment, 1789 - The Original Homeland Security.

Gun control means never having to say, "I missed you."

{{ DiscussionBoard.errors[7983131].message }}

Kingfish85

11 years ago

Originally Posted by SteveJohnson

Let me just add one thing - if your WP installs had a strong 8-12 character password with upper- and lower-case letters, numerals, and a punctuation character or two, you had nothing to worry about.

This isn't true. The problem here is brute forcing is causing a denial of service. The password may never be exploited however, the sheer number of connections attempting to log in causes a loss of service.

Thanks

Signature

|~| VeeroTech Hosting - sales @ veerotech.net
|~| High Performance CloudLinux & LiteSpeed Powered Web Hosting
|~| cPanel & WHM - Softaculous - Website Builder - R1Soft - SpamExperts
|~| Visit us @veerotech Facebook - Twitter - LinkedIn

{{ DiscussionBoard.errors[7983309].message }}

micksss

11 years ago

I like the way HostMantis handled this attack.

From an email they sent:

As you may have heard, there is currently a distributed attack against WordPress logins globally that is trying to hack WordPress installations by brute forcing the logins "wp-login.php" file.

Since this is a large and distributed attack, it is very serious and it's impact has been resulting in slow services.

Therefore we are doing our best to mitigate the impact by limiting access to WordPress logins.

In order to access your WordPress login, please do the following:

In your /public_html folder, create a text file (if one does not already exist) and name it ".htaccess"

Add the following text to the file:

<Files ~ "^wp-login.php">
Order deny,allow
Deny from all

Allow from x.x.x.x
</Files>

You will need to replace x.x.x.x with your cur rent IP address.

Not sure what your current IP is? Go to Google.com and type "what is my ip?"

[ 1 ] Thanks

Signature

Web Hosting Reviews ► www.CastironHosting.com ◄ Read or Submit Feedback on Web Hosts.
Web Hosting Coupons, Deals & Promos!

Need a Virtual Private Server? www.VPSPlan.com

{{ DiscussionBoard.errors[7984488].message }}

kevinlairre 11 years ago

micksss - that was a good solution ... Wish me and some other people were lucky enough for our hosting providers to have handled that way - cause that solution makes a lot more sense

Nonetheless - it's good to learn
- Thanks
Signature
>> How To Build PROFIT PULLING Blogs That Make You Money On AUTOPILOT <<
{{ DiscussionBoard.errors[7984522].message }}

Can't Login To Wordpress Cuz of DDoS attacks? Here's one quick fix ..

Trending Topics

Been a while! Any of you Old Timers here?

How much does the rebranding affect CR ?

Are billboards still effective in driving customers?

Boat and Jet Ski Rentals...... Door Hangers Effective?

A Very Strange Internet Problem