{"id":3044,"date":"2013-12-20T20:29:58","date_gmt":"2013-12-21T01:29:58","guid":{"rendered":"https:\/\/www.inmotionhosting.com\/support\/2013\/12\/20\/review-wordpress-login-attempts\/"},"modified":"2021-08-16T23:08:25","modified_gmt":"2021-08-17T03:08:25","slug":"review-wordpress-login-attempts","status":"publish","type":"post","link":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/","title":{"rendered":"Review WordPress login attempts"},"content":{"rendered":"
\n

Navigation:<\/h2>\n

Look at latest visitors in cPanel<\/a> Setup a cronjob to email WordPress login attempts<\/a> Blocking unwanted users from WordPress<\/a><\/p>\n<\/div>\n

Because WordPress is such a popular CMS used on the web today, many attackers will try to compromise a WordPress website. Knowing how to review WordPress login attempts in your access logs can help you understand and improve your WordPress security.<\/p>\n

This past April there was a large WordPress brute force attack<\/a> where hackers were trying to hack into many WordPress installs. In this guide we\u2019ll go over how you can be sure that your WordPress site isn\u2019t still getting attacked.<\/p>\n

<\/a><\/p>\n

Look at latest visitors in cPanel<\/h2>\n

To take a quick look to see who has been trying to access your WordPress administration panel, you can simply look in cPanel\u2019s Latest Visitors<\/strong> tool following these steps:<\/p>\n

    \n
  1. Login to cPanel<\/a><\/li>\n
  2. \"click<\/a>\n
    <\/div>\n

    Under the Metrics<\/strong> section, click on Latest Visitors<\/strong><\/p>\n

    <\/div>\n<\/li>\n
  3. \"click<\/a>\n
    <\/div>\n

    Beside your WordPress domain, click on View<\/strong><\/p>\n

    <\/div>\n<\/li>\n
  4. \"click<\/a>\n
    <\/div>\n

    Type in wp-login.php<\/strong> into the search box with the magnifying glass<\/strong><\/p>\n

    Then click the Settings cog<\/strong> on the right, and place a check beside the IP<\/strong>, URL<\/strong>,Time<\/strong>,Status<\/strong>, and Method<\/strong> fields.<\/p>\n

    <\/div>\n<\/li>\n
  5. \"wp-login<\/a>\n
    <\/div>\n

    Here you can see that the IP address 123.123.123.123<\/strong> first had a GET<\/strong> request for the wp-login.php<\/strong> script, followed by 4 POST<\/strong> attempts, all getting a 200 response<\/strong>.<\/p>\n

    On the 5th POST<\/strong> attempt the login was blocked and given a 503 response<\/strong>, and this is an indication of a user attemping to login to your WordPress admin, continually failing, and then being blocked by our Mod Security rules on the server.<\/p>\n

    You might also see that you have a ton of different IP addresses trying to hit your wp-login.php<\/strong> script here as well, and at a much higher volume. If you\u2019re seeing this, then that means your site could still be under a WordPress brute force attack.<\/p>\n

    <\/div>\n<\/li>\n<\/ol>\n

    <\/a><\/p>\n

    Setup a cronjob to email WordPress login attempts<\/h2>\n

    A lot of times you might not be reviewing your WordPress website on a daily basis. In these cases it can be helpful to setup a cronjob to send you a daily report of any attempted WordPress logins following these steps:<\/p>\n

      \n
    1. Login to cPanel<\/a><\/li>\n
    2. \"click<\/a>\n
      <\/div>\n

      Under the Advanced<\/strong> section, click on Cron jobs<\/strong><\/p>\n

      <\/div>\n<\/li>\n
    3. \"fill<\/a>\n
      <\/div>\n

      Under the Cron Email<\/strong> section, fill out your email address where you\u2019d like to receive the daily WordPress login attempt reports, and click Update Email<\/strong><\/p>\n

      <\/div>\n<\/li>\n
    4. \"add<\/a>\n
      <\/div>\n

      Now under the Add New Cron Job<\/strong> section, change the Common Settings<\/strong> drop-down to be Once a day (0 0 * * *)<\/strong><\/p>\n

      This will default to sending you an email at midnight local server time, but you can adjust the Hour<\/strong> field if you\u2019d like to have it email you a different time of day.<\/p>\n

      Now for the Command<\/strong> field, you\u2019d want to enter in the following command, making sure to replace ~\/access-logs\/example.com<\/strong> with your own WordPress website\u2019s log:<\/p>\n

      egrep \u201cPOST .*wp-login.php\u201d ~\/access-logs\/example.com<\/strong> | awk \u2018{print $1,$4,$5,$6,$7,substr($0, index($0,$12))}\u2019 | awk \u2018{print $1}\u2019 | sort -n | uniq -c | sort -n | sed \u2018s\/[ ]*\/\/\u2019<\/p>\n

      Then click on Add New Cron Job<\/strong><\/p><\/li>\n

    5. The email report will give you a list of IP addresses that were accessing your wp-login.php<\/strong> script, and how many times they did so, and look like this:\n
      30 58.10.130.202 30 78.164.24.100 31 223.207.219.14 32 171.101.134.230 32 171.5.251.198 32 223.204.248.61 32 88.12.44.113 33 49.49.168.61 36 223.205.123.216 60 95.135.187.135 100 61.109.125.146<\/pre>\n
      In this case if we received an email report like above, we can clearly see that we possibly have a brute force attack happening on our WordPress sites, as we have multiple IPs hitting the wp-login.php<\/strong> script multiple times.<\/p>\n<\/li>\n
      <\/div>\n<\/ol>\n
      <\/a><\/p>\n
      Blocking unwanted users from WordPress<\/h2>\n
      If you notice that you have IP addresses trying to access your WordPress admin that shouldn\u2019t be, you can go ahead and block unwanted users from your site using .htaccess<\/a>.<\/p>\n
      In the example email report above we saw multiple IPs had multiple login attempts, we can block these IPs from even being able to send out website a request by using these .htaccess<\/strong> rules at the top of your .htaccess<\/strong> file:<\/p>\n
      deny from 58.10.130.202 deny from 78.164.24.100 deny from 223.207.219.14 deny from 171.101.134.230 deny from 171.5.251.198 deny from 223.204.248.61 deny from 88.12.44.113 deny from 49.49.168.61 deny from 223.205.123.216 deny from 95.135.187.135 deny from 61.109.125.146<\/pre>\n
      Now if any of these IPs trys to access your website again, they will be immediately given a 403 access denied<\/strong> error and won\u2019t be able to attempt to login to your WordPress site any longer.<\/p>\n","protected":false},"excerpt":{"rendered":"
      Navigation: Look at latest visitors in cPanel Setup a cronjob to email WordPress login attempts Blocking unwanted users from WordPress Because WordPress is such a popular CMS used on the web today, many attackers will try to compromise a WordPress website. Knowing how to review WordPress login attempts in your access logs can help you Read More ><\/a><\/p>\n","protected":false},"author":57014,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4325,56],"tags":[],"class_list":["post-3044","post","type-post","status-publish","format-standard","hentry","category-wordpress-hosting","category-wordpress"],"acf":[],"yoast_head":"\nReview WordPress login attempts | InMotion Hosting<\/title>\n<meta name=\"description\" content=\"Learn how to review your WordPress access logs for brute force login attempts to help understand and implement better WordPress security.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Review WordPress login attempts | InMotion Hosting\" \/>\n<meta property=\"og:description\" content=\"Learn how to review your WordPress access logs for brute force login attempts to help understand and implement better WordPress security.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/\" \/>\n<meta property=\"og:site_name\" content=\"InMotion Hosting Support Center\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/inmotionhosting\/\" \/>\n<meta property=\"article:published_time\" content=\"2013-12-21T01:29:58+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-08-17T03:08:25+00:00\" \/>\n<meta name=\"author\" content=\"InMotion Hosting Contributor\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@https:\/\/twitter.com\/InMotionHosting\" \/>\n<meta name=\"twitter:site\" content=\"@InMotionHosting\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"InMotion Hosting Contributor\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/\"},\"author\":{\"name\":\"InMotion Hosting Contributor\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644\"},\"headline\":\"Review WordPress login attempts\",\"datePublished\":\"2013-12-21T01:29:58+00:00\",\"dateModified\":\"2021-08-17T03:08:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/\"},\"wordCount\":686,\"commentCount\":40,\"publisher\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#organization\"},\"articleSection\":[\"WordPress Hosting\",\"WordPress Tutorials\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/\",\"name\":\"Review WordPress login attempts | InMotion Hosting\",\"isPartOf\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#website\"},\"datePublished\":\"2013-12-21T01:29:58+00:00\",\"dateModified\":\"2021-08-17T03:08:25+00:00\",\"description\":\"Learn how to review your WordPress access logs for brute force login attempts to help understand and implement better WordPress security.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.inmotionhosting.com\/support\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Review WordPress login attempts\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#website\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/\",\"name\":\"InMotion Hosting Support Center\",\"description\":\"Web Hosting Support & Tutorials\",\"publisher\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.inmotionhosting.com\/support\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#organization\",\"name\":\"InMotion Hosting\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg\",\"contentUrl\":\"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg\",\"width\":696,\"height\":696,\"caption\":\"InMotion Hosting\"},\"image\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/inmotionhosting\/\",\"https:\/\/x.com\/InMotionHosting\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644\",\"name\":\"InMotion Hosting Contributor\",\"description\":\"InMotion Hosting contributors are highly knowledgeable individuals who create relevant content on new trends and troubleshooting techniques to help you achieve your online goals!\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/inmotion-hosting\/\",\"https:\/\/x.com\/https:\/\/twitter.com\/InMotionHosting\"],\"url\":\"https:\/\/www.inmotionhosting.com\/support\/author\/inmotion-hosting-contributor\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Review WordPress login attempts | InMotion Hosting","description":"Learn how to review your WordPress access logs for brute force login attempts to help understand and implement better WordPress security.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/","og_locale":"en_US","og_type":"article","og_title":"Review WordPress login attempts | InMotion Hosting","og_description":"Learn how to review your WordPress access logs for brute force login attempts to help understand and implement better WordPress security.","og_url":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/","og_site_name":"InMotion Hosting Support Center","article_publisher":"https:\/\/www.facebook.com\/inmotionhosting\/","article_published_time":"2013-12-21T01:29:58+00:00","article_modified_time":"2021-08-17T03:08:25+00:00","author":"InMotion Hosting Contributor","twitter_card":"summary_large_image","twitter_creator":"@https:\/\/twitter.com\/InMotionHosting","twitter_site":"@InMotionHosting","twitter_misc":{"Written by":"InMotion Hosting Contributor","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/#article","isPartOf":{"@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/"},"author":{"name":"InMotion Hosting Contributor","@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644"},"headline":"Review WordPress login attempts","datePublished":"2013-12-21T01:29:58+00:00","dateModified":"2021-08-17T03:08:25+00:00","mainEntityOfPage":{"@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/"},"wordCount":686,"commentCount":40,"publisher":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#organization"},"articleSection":["WordPress Hosting","WordPress Tutorials"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/","url":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/","name":"Review WordPress login attempts | InMotion Hosting","isPartOf":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#website"},"datePublished":"2013-12-21T01:29:58+00:00","dateModified":"2021-08-17T03:08:25+00:00","description":"Learn how to review your WordPress access logs for brute force login attempts to help understand and implement better WordPress security.","breadcrumb":{"@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/review-wordpress-login-attempts\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.inmotionhosting.com\/support\/"},{"@type":"ListItem","position":2,"name":"Review WordPress login attempts"}]},{"@type":"WebSite","@id":"https:\/\/www.inmotionhosting.com\/support\/#website","url":"https:\/\/www.inmotionhosting.com\/support\/","name":"InMotion Hosting Support Center","description":"Web Hosting Support & Tutorials","publisher":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.inmotionhosting.com\/support\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.inmotionhosting.com\/support\/#organization","name":"InMotion Hosting","url":"https:\/\/www.inmotionhosting.com\/support\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/","url":"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg","contentUrl":"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg","width":696,"height":696,"caption":"InMotion Hosting"},"image":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/inmotionhosting\/","https:\/\/x.com\/InMotionHosting"]},{"@type":"Person","@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644","name":"InMotion Hosting Contributor","description":"InMotion Hosting contributors are highly knowledgeable individuals who create relevant content on new trends and troubleshooting techniques to help you achieve your online goals!","sameAs":["https:\/\/www.linkedin.com\/company\/inmotion-hosting\/","https:\/\/x.com\/https:\/\/twitter.com\/InMotionHosting"],"url":"https:\/\/www.inmotionhosting.com\/support\/author\/inmotion-hosting-contributor\/"}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"primary_category":null,"_links":{"self":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts\/3044","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/users\/57014"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/comments?post=3044"}],"version-history":[{"count":2,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts\/3044\/revisions"}],"predecessor-version":[{"id":84363,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts\/3044\/revisions\/84363"}],"wp:attachment":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/media?parent=3044"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/categories?post=3044"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/tags?post=3044"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}