1,023 blocked malicious login attempts. Who trying to steal my blog? Any advises?
-
My new blog growing up fast and I'm about the break the Alexa million and I discovered 1,023 blocked malicious login attempts today. I'm really got scared when I saw this number. I'm using WordPress, any advises?
-
There will definitely be cases out there like you described, Massimiliano. It's a wild world out there. We can only do so much to protect ourselves.
-
Honestly, I would strongly suggest to avoid blocking traffic on a geographic basis, these days you never know where traffic will come from and why.
User sitting in the building next to yours but accessing internet from a corporate network may appear as connecting from China.
Legit bot from services you are paying for may appear as crawling from Sweden, and other legit bot you don't even know about but which let you reach additional audience may appear as connecting from the other side of the world.
Blocking traffic is positively dangerous, the only case where I would consider it a good decision is when blocking blacklisted ips, and even this case I would suggest to secure the blacklist is updated regularly to avoid blocking false positive.
-
Eslam - Many great suggestions here of the things you can do right now to help you with these hack attempts. One thing I'd like to add is that we use a service/plugin called Sucuri. We've had good luck with it so far. You can learn more about them here: http://sucuri.net/
Regarding the approach of blocking traffic from other countries, my thought is this. Does traffic from those countries bring any value to you and do you give value to those visitors? If you answer no to this question, then why not block it? For example, a local pizza shop's website in Portland, Oregon probably doesn't care bout web traffic from Lithuania and vice versa.
-
Bulletproof Security is great and has many features to blocking such attempts and making it harder for those scripts that are just constantly scanning for the usual vulnerabilities.
-
theres a wordpress plugin you can use that limits the number of login attempts (I used to use it but I forgot the name of it)
-
Instructions here: https://wordpress.org/support/topic/how-to-change-from-wp-loginphp-to-login
-
It's won't type my password there really. I don't know ...
-
I don't think it's easy to change it because there PHP complicated things that I don't know about. But, I will search for a trusted plugin or something like that. Seems like a good solution.
-
I don't know, it's a very abuse thing to ban traffic from a country. If you are saying these attacks are automated so they are not humans?
-
I've. But, do you think it's enough. I'm talking about that I'm talking with you right now and there's someone right there trying to steal my thing. Hard feeling really.
-
I agree with Massimillano here.
Three things you should do for all common CMS systems (WP, Joomla, ect..)
First change the admin directory to something else. When doing this you likely have to edit configuration files to point to the new location which is pretty simple.
Second protect admin directory with .htaccess & .htpasswd. There is a nice generator I have used on some of my sites in the past here.
Third create a honeypot / auto IP ban for malicious crawlers or script kiddies. There are several plugins for this if you search the keywords honeypot + cms.
-
Change the name of the login page, I mean in addition to having a strong password of course.
Those automated scripts look first for the known wp login page if they don't find it the will give up, if they do they will keep trying forever and ever, an unecessary load for your servers.
-
This is a very common thing. Most of these attacks are automated, coming from China or Eastern Europe. You may consider banning traffic from those countries all together if it's not relevant to you. Change the default admin user name to something else. And do as EGOL recommended - set a really strong password. And then change that password every few months.
-
Make a really strong password.
Got a burning SEO question?
Subscribe to Moz Pro to gain full access to Q&A, answer questions, and ask your own.
Browse Questions
Explore more categories
-
Moz Tools
Chat with the community about the Moz tools.
-
SEO Tactics
Discuss the SEO process with fellow marketers
-
Community
Discuss industry events, jobs, and news!
-
Digital Marketing
Chat about tactics outside of SEO
-
Research & Trends
Dive into research and trends in the search industry.
-
Support
Connect on product support and feature requests.
Related Questions
-
Blog migration
Hi We have 4 websites - 1 for company and 3 for each products. Currently all our blog posts are located on the company website company.com/blog. We will be separating out the blog so that product blogs will be in each product website. i.e. from company.com/blog to: company.com/blog product1.com/blog product2.com/blog product3.com/blog This is with the aim of helping SEO for each of the product websites; and improving user experience so users can easily navigate around the product pages if they are reading a blog post on the product. So now we have to consider migration. We will migrate/copy over all blog posts to each of the relevant product websites, but should we: A. keep the old blog posts on company.com/blog and do a rel=canonical B. only show blog preview on company.com/blog which will link to the new product.com/blog (and using 301 redirect) C. 301 redirect all blog posts from company.com/blog altogether Any suggestions on which of the above options to take would be greatly appreciated in terms of SEO and other considerations
Content Development | | bnulab0 -
Best way to handle blogs for a customer with a chain business?
I have a new customer who owns three local gyms. Each one has its own unique url. I intend to do some blogging for him, and would like it to be effective for SEO. Obviously, publishing duplicate content is out, but writing tons of new posts each month is beyond our scope. Would you recommend having one separate blog (with its own url) that is linked from each of the 3 main sites, or would it be better to create a blog on each site and alternate publishing articles on each one, putting a unique intro and link to the main post on the other two?
Content Development | | ScottImageWorks0 -
Repurpose/reuse blog content - email address to make available for this
Hi, From Rand's recent Whiteboard Friday, I learned this: "Have right on the blog page the email address to use if they want to repurpose/reuse the content. That way if someone wants to give us a backlink and quote/reference our blog, they have an easy way to get permission." My question is, what do I say with the email address when I list our contact email? Something like 1. Just list the email address 2. "To reuse/repurpose our content, please contact adress@email.com." or something else?
Content Development | | BobGW0 -
Blog Pages
Our blog has got more than one page (containing blog posts) what do we do about the fact that we have 20 odd blog pages but only the first page has a Meta title and description? Very similar to the moz blog? Thanks
Content Development | | Bossandy0 -
Blocking websites.
We have noticed an abundance of requests for some free colour cards on our website, however these are coming from a russian freebie website. how can i block this website, so the link from that forum doesn't work?
Content Development | | TeamacPaints0 -
Rewrite of blog posts
I have to admit. Sometimes, when i write a blog post, I'm a bit lazy. I don't concentrate on the on page optimization portion of the blog post. I used to. But, as of late, I haven't. I was wondering if it was worth it to tweak my blog posts just a bit with a few keywords to improve my on page optimization. Or, do you think that it is too late and not worth the trouble.
Content Development | | jamesjd80 -
Can someone define what a low quality blog is supposed to look like?
I know the recent Google update devalued a lot of low quality blogs, but i'm having a hard time understanding what can be considered low quality? My site is www.247VirtualAssistant.com and it wa sitting in the top 3 for all my keywords(virtual assistant, virtual assistants etc etc). Last month everything tanked and now on the 2nd and 3rd page for my keywords. I'm thinking this is because of a lot of my links got devalued but with my limited SEO knowledge, i'm having a hard time identifiyng these. Please help!
Content Development | | Shajan0 -
What are you doing to convert blog readers to inquiries/leads?
I'm curious what tactics people are finding successful in converting readers into leads, inquiries, or sales. Anyone feel like sharing?
Content Development | | BedeFahey1