One of my clients has a GoDaddy-hosted Secure WordPress site that has numerous attempts to login recently. Attempted logins aren’t new, but these attempts have been targeting 4 specific accounts that are all valid, not all using the same username format (e.g. not guessed) and at least one of those accounts has NEVER posted or published to the site and has no social media presence to tie the user/account to the company in question.
Additionally, one of the 4 users being targeted was created in July 2023, \*after\* the mostly recently published GoDaddy breach and there is another user, created around Christmas, that is not being targeted.
We don’t run a lot of plugins (only Advanced Custom Redirect, CookieYes (for GDPR consent), Formidable Forms, Performance Lab and Yoast).
I tried to inquire with GoDaddy, but they don’t support email tickets (only phone, text and chat) and their AI agent is ill-equipped to handle this kind of issue.
Anyone else seeing this kind of behavior lately on their lately (on or off of GoDaddy)? Any recommendations on identifying the how the data was leaked and/or acquired?
[ad_2]
That’s normal – WordPress leaks the usernames of the site ([https://hackertarget.com/wordpress-user-enumeration/](https://hackertarget.com/wordpress-user-enumeration/)). Using strong passwords and keeping your plugins is (generally) all you need to defeat. If you want to block/reduce login attempts, install Wordfence – it prevents username enumeration (it can also block access to xmlrpc, which is another brute force attack entry point) and will block failed repeated attempts. [Here are my Wordfence settings](https://hosting.bluesix.co/my-wordfence-settings/).
*”GoDaddy-hosted Secure WordPress site”*… lol. Why do people still use GoDaddy?