Wordpress Security

Admin · Jan 15, 2013

If you are running a WP site, check out the Wordfence security plugin, it offers awesome functions even in the free version.

I had a few of my accounts suspended by my host due to server overloads, turns out the Baidu search engine in China was hammering them so Wordfence lets me block their IPs, plus add a command to throttle the number of hits per minute based on user, bots, etc.

It also shows attempts to login to the admin page, I am getting hits daily on this. If you do nothing else, rename your "admin" account to something else as I am seeing bots using this username and password hacks to try to get in.

An unknown location at IP 5.135.185.89 attempted a failed login as "admin".
IP: 5.135.185.89 [block]
Hostname: ks3290602.kimsufi.com
56 minutes ago

Do yourself a favour and try this plugin, it is eye-opening.

Admin

GeekSlash · Jan 18, 2013

I suggest installing it alongside both Bulletproof Security which mainly protects your site by modifying your htaccess file and Login Lockdown which prevents brute force login attempts.

Admin · Jan 20, 2013

I'm still getting loads of sites trying to login to my admin user.

Rename your admin user from "admin" to something else, then they have to guess your username as well as your password.

UPDATE `name_wrdp1`.`wp_users` SET `user_login` = 'NewName' WHERE `wp_users`.`ID` =1;

fish · Jan 20, 2013

admin said:
I'm still getting loads of sites trying to login to my admin user.

Rename your admin user from "admin" to something else, then they have to guess your username as well as your password.

Here's one I use that does this and much, much more 'Better WP Security'
It has plenty of options to harden all aspects of the install and tells you what needs doing & if you have done it or not.