Atacuri masive asupra site-urilor cu WP

[gupi]

Mi se par utile WordPress › Captcha « WordPress Plugins, atat pentru partea de admin cat si comentarii, spam etc. Functioneaza foarte bine.
Impreuna cu blocarea accesului in directorul wp-admin cu .htaccess

Nu e chiar asa, chiar daca incerc sa ma conectez cu wp-login ca admin, de ex site.ro/wp-login.php?redirect_to=http%3A%2F%2Fwww.site.ro%2Fw p-admin%2F&reauth=1, tot la wp-admin ajunge si este blocat din .htaccess

Mihai, sunt doua aspecte distincte aici
1) cum sa te protejezi impotriva unor atacuri "brute-force" mai mult sau mai putin sporadice, caz in care protejarea cu .htaccess sau alte pluginuri de securitate este absolut OK
2) cum raspunzi in cazul unor atacuri targetate pe wp-login.php, care vin de la foarte multe adrese IP (~100k) ?
Uite cam asa arata log-urile acum pe un singur domeniu; in perioada de varf atacului totul se intampla la frecventa de ~5-10 accesari pe secunda.

====
50.117.80.38 - - [15/Apr/2013:23:18:05 +0300] "POST /wp-login.php HTTP/1.1" 200 3184 "-" "-"
204.93.60.31 - - [16/Apr/2013:00:10:46 +0300] "GET /wp-login.php HTTP/1.1" 200 2239 "-" "-"
204.93.60.31 - - [16/Apr/2013:00:11:00 +0300] "POST /wp-login.php HTTP/1.1" 200 3184 "-" "-"
204.93.60.12 - - [16/Apr/2013:00:40:18 +0300] "GET /wp-login.php HTTP/1.1" 200 2239 "-" "-"
204.93.60.12 - - [16/Apr/2013:00:40:18 +0300] "GET /wp-login.php HTTP/1.1" 200 2239 "-" "-"
204.93.60.12 - - [16/Apr/2013:00:40:34 +0300] "POST /wp-login.php HTTP/1.1" 200 3184 "-" "-"
204.93.60.12 - - [16/Apr/2013:00:40:36 +0300] "POST /wp-login.php HTTP/1.1" 200 3184 "-" "-"
176.123.0.246 - - [16/Apr/2013:01:30:49 +0300] "GET /wp-login.php HTTP/1.0" 200 2239 "-" "-"
176.123.0.246 - - [16/Apr/2013:01:31:03 +0300] "POST /wp-login.php HTTP/1.0" 200 3184 "-" "-"
216.172.147.57 - - [16/Apr/2013:02:46:05 +0300] "GET /wp-login.php HTTP/1.1" 200 2239 "-" "-"
216.172.147.57 - - [16/Apr/2013:02:46:19 +0300] "POST /wp-login.php HTTP/1.1" 200 3184 "-" "-"
216.172.147.185 - - [16/Apr/2013:04:02:46 +0300] "GET /wp-login.php HTTP/1.1" 200 2239 "-" "-"
216.172.147.185 - - [16/Apr/2013:04:03:00 +0300] "POST /wp-login.php HTTP/1.1" 200 3184 "-" "-"
204.93.60.174 - - [16/Apr/2013:04:27:52 +0300] "GET /wp-login.php HTTP/1.1" 200 2239 "-" "-"
204.93.60.174 - - [16/Apr/2013:04:27:52 +0300] "GET /wp-login.php HTTP/1.1" 200 2239 "-" "-"
204.93.60.174 - - [16/Apr/2013:04:28:06 +0300] "POST /wp-login.php HTTP/1.1" 200 3184 "-" "-"
204.93.60.174 - - [16/Apr/2013:04:28:07 +0300] "POST /wp-login.php HTTP/1.1" 200 3184 "-" "-"
204.93.60.75 - - [16/Apr/2013:05:18:43 +0300] "GET /wp-login.php HTTP/1.1" 200 2239 "-" "-"
204.93.60.75 - - [16/Apr/2013:05:18:59 +0300] "POST /wp-login.php HTTP/1.1" 200 3184 "-" "-"
216.172.147.12 - - [16/Apr/2013:05:46:10 +0300] "GET /wp-login.php HTTP/1.1" 200 2239 "-" "-"
216.172.147.12 - - [16/Apr/2013:05:46:10 +0300] "GET /wp-login.php HTTP/1.1" 200 2239 "-" "-"
216.172.147.12 - - [16/Apr/2013:05:46:24 +0300] "POST /wp-login.php HTTP/1.1" 200 3184 "-" "-"
216.172.147.12 - - [16/Apr/2013:05:46:24 +0300] "POST /wp-login.php HTTP/1.1" 200 3184 "-" "-"
176.123.0.246 - - [16/Apr/2013:06:39:15 +0300] "GET /wp-login.php HTTP/1.0" 200 2239 "-" "-"
176.123.0.246 - - [16/Apr/2013:06:39:15 +0300] "GET /wp-login.php HTTP/1.0" 200 2239 "-" "-"
176.123.0.246 - - [16/Apr/2013:06:39:29 +0300] "POST /wp-login.php HTTP/1.0" 200 3184 "-" "-"
176.123.0.246 - - [16/Apr/2013:06:39:30 +0300] "POST /wp-login.php HTTP/1.0" 200 3184 "-" "-"
204.93.60.20 - - [16/Apr/2013:07:31:11 +0300] "GET /wp-login.php HTTP/1.1" 200 2239 "-" "-"
204.93.60.20 - - [16/Apr/2013:07:31:26 +0300] "POST /wp-login.php HTTP/1.1" 200 3184 "-" "-"
176.123.0.242 - - [16/Apr/2013:07:48:41 +0300] "GET /wp-login.php HTTP/1.0" 200 2239 "-" "-"
176.123.0.242 - - [16/Apr/2013:07:48:41 +0300] "GET /wp-login.php HTTP/1.0" 200 2239 "-" "-"
204.93.60.182 - - [16/Apr/2013:07:48:55 +0300] "POST /wp-login.php HTTP/1.1" 200 3184 "-" "-"
204.93.60.182 - - [16/Apr/2013:07:48:55 +0300] "POST /wp-login.php HTTP/1.1" 200 3184 "-" "-"
198.144.116.181 - - [16/Apr/2013:08:20:51 +0300] "GET /wp-login.php HTTP/1.1" 200 2239 "-" "-"
198.144.116.181 - - [16/Apr/2013:08:21:06 +0300] "POST /wp-login.php HTTP/1.1" 200 3184 "-" "-"
204.93.60.20 - - [16/Apr/2013:08:55:32 +0300] "GET /wp-login.php HTTP/1.1" 200 2239 "-" "-"
204.93.60.20 - - [16/Apr/2013:08:55:32 +0300] "GET /wp-login.php HTTP/1.1" 200 2239 "-" "-"
204.93.60.20 - - [16/Apr/2013:08:55:47 +0300] "POST /wp-login.php HTTP/1.1" 200 3184 "-" "-"
204.93.60.20 - - [16/Apr/2013:08:55:46 +0300] "POST /wp-login.php HTTP/1.1" 200 3184 "-" "-"
50.117.80.220 - - [16/Apr/2013:09:54:46 +0300] "GET /wp-login.php HTTP/1.1" 200 2239 "-" "-"
====

E, daca ai foarte multe cereri pe wp-login.php, inainte de a-ti pune problema securitatii site-ului ajungi sa-ti pui problema stabilitatii lui.

Daca esti pe un cont shared, risti sa ajungi repejor la limitarile impuse (de CloudLinux de exemplu) si site-ul sa devina inaccesibil.
Acesta e motivul pentru care am propus -in cazurile extreme- un fisier wp-login.php gol, care sa reduca incarcarea.

In rest, toate celelalte sugestii sunt perfect valabile.