[ad_1]
So yeah.. I changed the wp-admin link to something else, and white listed only the IPs we need.
Somehow the botnet is still submitting login form requests.. it’s coming from multiple IP addresses and doesn’t stop. It’s clinged onto one username it’s confirmed is real… and is just trying over and over again.
I have whitelisting enabled and tested it from another IP address.. it’s confirmed I cannot access it. How can I further block any possibility of these foreign IPs from processing login requests?
Thanks.
[ad_2]
The wp-login page is not the only way you can attempt to login. There’s also the xml-rpc API and the REST api that accept credentials.
You really need some sort of firewall, like WordFence on the WordPress side or Cloudflare in front of your site.