brute force on wp-login.php
 

What pisses me off is that my stats (awstats etc) gets messed up by them, there is no way to have accurate stats because more hits are from bots than from actual visitors.
/rant

http://configserver.com/cp/csf.html and ban them manually if you can't use it to automatically ban them. I think there is a setting to do it. :)

theres a patch for that!

If you mean for attacks then I installed wp harden plugin which redirects wp-login.php to home page.

Now I am looking for patch to see accurate awstats. Because now my numbers are inflated by bots and stats are basically useless, no idea how many of those are real visitors, how many bots.

same here, seems like almost every wordpress site has this. What are those bots trying to accomplish? No way the passes can be cracked. Seems so useless in my opinion.

Very nice, however I have an issue: I installed harden wp plugin so hits to wp-login.php are redirected to home page, meaning that awstats would count them because it won't be backend hit (I assume).
Its either I prevent attacks (by using harden wp) but have compromised awstats or I do not prevnt attacks but fix awstats using this method :)

I had the same problem but I've only allowed my IP to access the loginpage and now I get accurate (and disappointing) stats. It was my host who sat it up so don't ask me how :)

btw for blogs I like to use the jetpack stats rather than awstats, it's real time too..

it's even worse if you are running forums :2 cents:

Ban ip's for unsuccessful logins

EDIT** Never mind. Looking at the directory structure online wp-login.php is in the root directory.

Use a more advanced statistics program.

Here's a trick you can try. I haven't tried it but it looks like it should work.

Password protect your admin directory with .htacess and then use .htaccess to filematch that protection to your login.php file.

http://www.inmotionhosting.com/suppo...n-php-attempts

Only allow access from your static ips to the admin section deny all else.

yup use htaccess to only allow your ip in admin

htaccess block everyone from admin, do signups via the front end and disable redirection to admin after signup

what would that htaccess command look like?

file placed in wp-admin dir

or this

http://wordpress.org/plugins/hc-custom-wp-admin-url/ :)

this is a huge pain in the ass

Question - does awstats count denied visitors? I mean those would still technically hit the site (and show up on the stats?).

Doesn't show up for me

10000's of plugin to autoban after x attempts.

You can change this file name with no issues.

Great thread. Thanks for the experts pitching in. Shit is frustrating.