Subject: Wordpress and Joomla Brute Force Attacks

The following message was sent by our staff regarding the above subject:

Update 08/18/15
For a 2-Step protection method, use the [Secure Directories] tool inside your Hosting Control Panel to create a username/password login for your Wordpress or Joomla installation so that it has an additional layer which must be logged into to make administrative changes.

Update 10/6/14
While the majority of major attacks have long since subsided, it still rears its ugly head from time to time. We've again updated the block code as the new attack favors xmlrpc.php over wp-login.php.

The new code looks like this:

<FilesMatch "^(wp-login|xmlrpc)\.php$">
Order Allow,Deny
#(replace with YOUR IP)
Allow from 123.123.123.123

#(additional lines can be added for multiple IP access (remove the '#'))
#(leave off the last number to allow an IP range for alternating IPs)
#Allow from 123.123.123.121
#Allow from 123.123.123.
#Deny from all
</FilesMatch>


Update 11/7/13
Wordpress has published their own advice, plugins, methods, tools and otherwise to help with this problem.
Please feel free to try these methods as well:
http://codex.wordpress.org/Brute_Force_Attacks

Update 7/25/13
The majority of attacks have subsided over the last month and many have been deterred by your efforts to lock down your sites. We still *STRONGLY* recommend you follow all the steps outlined below.

Update 6/28/13
It has been confirmed that clients utilizing the [Custom Error Pages] tool should disable the redirect for the '403 - Forbidden' block as this is absolutely a subversion of the .htaccess code. Even if the attack is diverted by IP restrictions, it will cause the redirected page to load repeatedly as the attack continually hammers the server until it overloads and crashes.

Update 6/17/13
The attacks have slowed, but unfortunately still continue. We continue to update our firewall as we go.

Update 6/10/13
The good news is the majority of these attacks have either subsided or are being blocked by your updated security, and or our network-wide firewall. We will continue to monitor, update and block attacks as best as possible. Please let us know if you have any questions!

Update 6/9/13
We have recently learned that if you block access to wp-login.php or /administrator/index.php as suggested below but are also using the [Custom Error Pages] tool that it may subvert the IP locking process and if your site is involved in a crash, it may be removed by support. This mostly applies to Forbidden requests, or others that redirect to another page as this causes the attacker to repeatedly load that page instead of being stopped.

This can be verified by removing your IP (that you added) and trying to access the target file. If you're blocked, then you are safe. If not, then your redirect is interfering and should be removed.

Update 6/8/13
We have blocked many of the IPs involved in the attacks and will continue to monitor and update the situation. Please update your files as described below.

6/7/13
There has been a rash of Wordpress and Joomla brute-force login attacks hitting our networks and across the internet which have been causing server down time and other issues. We are actively trying to block these attacks, but prevention on our client end will help to solve and even prevent the problem as well as protect your sites from these malicious hackers.

Please read the following information on how to secure your login files so that only your specific IP or IPs will have access as this will also stop heavy server loads from repeated hammering.

If you have questions, please contact support@webmasters.com

---

Has your site been targeted by a specific IP or various IP's? Notice they are targeting a specific file? For the most part the targets are usually credential related like login pages and can be avoided.

Excessive requests to one specific file can cause a server overload and now your site is offline indefinitely due to server reboot and potentially administrative action to stabilize the server.

We suggest adding these lines to your existing .htaccess file or creating an .htaccess file. In this example we are using the file associated with WordPress and it's login page. This file can be modified for any file that may be at risk of being targeted.

Please use this code for Wordpress in your /wordpressdirectory/.htaccess file:

ex:
/httpdocs/ (root directory installations)
/wordpress/

<FilesMatch "^(wp-login|xmlrpc)\.php$">
Order Allow,Deny
Allow from 123.123.123.123 #(replace with YOUR IP)
#Allow from 123.123.123.121 #additional lines can be added from multiple IP access
#Deny from all
</FilesMatch>

Please use this code for Joomla in your /joomla-directory/administrator/.htaccess file:

ex:
/joomla/administrator
/httpdocs/administrator (root directory installations)

<FilesMatch index.php>
Order Allow,Deny
Allow from 123.123.123.123 #(replace with YOUR IP)
#Allow from 123.123.123.121 #additional lines can be added from multiple IP access
#Deny from all
</FilesMatch>

This should protect this file and only allow specified IP(s) access. This code can also be duplicated and modified to protect other files on your account.

Please feel free to contact us again if you have any other questions or issues. Thank you for contacting us.

Best regards,

WEBMASTERS.COM
Support Team