Greetings ... maybe someone had experience protecting admins from brute force? On the server, hundreds of sites. There is protection by the number of connections, but the bots have now become smarter - they make only a small number of requests per minute, which is almost imperceptible, while creating an unnecessary, unpleasant load on the processor.

46.172.83.5 - - [28/Jun/2016:11:36:55 +0300] "POST /wp-login.php HTTP/1.1" 403 2769 "-" "Mozilla/5.0 (Windows NT 5.1; rv:29.0) Gecko/20100101 Firefox/29.0" "-" 46.172.83.5 - - [28/Jun/2016:11:37:04 +0300] "POST /wp-login.php HTTP/1.1" 200 5021 "-" "Mozilla/5.0 (Windows NT 5.1; rv:29.0) Gecko/20100101 Firefox/29.0" "-" 46.172.83.5 - - [28/Jun/2016:11:37:09 +0300] "GET /wp-login.php HTTP/1.1" 200 3498 "-" "Mozilla/5.0 (Windows NT 5.1; rv:29.0) Gecko/20100101 Firefox/29.0" "-" 46.172.83.5 - - [28/Jun/2016:11:37:09 +0300] "POST /wp-login.php HTTP/1.1" 200 4488 "-" "Mozilla/5.0 (Windows NT 5.1; rv:29.0) Gecko/20100101 Firefox/29.0" "-" 46.172.83.5 - - [28/Jun/2016:11:37:10 +0300] "GET /wp-login.php HTTP/1.1" 200 3316 "-" "Mozilla/5.0 (Windows NT 5.1; rv:29.0) Gecko/20100101 Firefox/29.0" "-" 46.172.83.5 - - [28/Jun/2016:11:37:11 +0300] "POST /wp-login.php HTTP/1.1" 200 4307 "-" "Mozilla/5.0 (Windows NT 5.1; rv:29.0) Gecko/20100101 Firefox/29.0" "-" 46.172.83.5 - - [28/Jun/2016:11:37:12 +0300] "GET /wp-login.php HTTP/1.1" 403 2769 "-" "Mozilla/5.0 (Windows NT 5.1; rv:29.0) Gecko/20100101 Firefox/29.0" "-" 46.172.83.5 - - [28/Jun/2016:11:37:12 +0300] "GET /wp-login.php HTTP/1.1" 403 2769 "-" "Mozilla/5.0 (Windows NT 5.1; rv:29.0) Gecko/20100101 Firefox/29.0" "-" 46.172.83.5 - - [28/Jun/2016:11:37:12 +0300] "POST /wp-login.php HTTP/1.1" 403 2769 "-" "Mozilla/5.0 (Windows NT 5.1; rv:29.0) Gecko/20100101 Firefox/29.0" "-"

What to do with them? Maybe share your experiences? ..

I tried to do it with nginx, but the problem is ...

    2 answers 2

    Fail2ban can help. It is a tool that automatically bans nodes suspected of malicious activity in iptables, based on the analysis of logs. A ban can be permanent or temporary - fail2ban can unban them over time. Flexible settings, "everyone uses."

    To analyze login attempts in WordPress, you will need to install this WP plugin so that login attempts are recorded in syslog. Read more here (in English)

    • Thanks for the answer, but the question was in the "mass". If we proceed from your answer, I will have to install a plug-in for WP on hundreds of sites, which is unrealistic ... - Alexey Sekretny
    • @AlekseySekretny can be without a plugin, fail2ban can work and ban itself, I also recommend - andreymal
    • @andreymal have examples of configs? - Aleksey Sekretny
    • @ AlexeySecret is not with you, but in Google WordPress should be in bulk, and with fail2ban there are also examples for different situations - andreymal

    Change the login address from / wp-login.php to something else. 95% of bots will be eliminated. They are very stupid, they are simply written in - where is the login at WordPress. Do so - so that they do not know :)

    • Do you think a simple rewrite will help? - Aleksey Sekretny
    • it is necessary that the old address /wp-login.php - login was impossible to produce. So no, it can't. It is necessary in the code to replace links to wp-login.php. In WordPress probably there is such an option. And then it is already possible and revrayt - only that the old address did not work. - Goncharov Alexander
    • Well, in the heading it is written that there must be a mass character, I cannot change the code of each site :( - Aleksey Sekretny
    • Then sorry, I can not help. But I know that there are server utilities that can keep a close eye on requests for specific URLs. - Goncharov Alexander