In dealing WordPress Login (wp-login.php) brute force attack, previously, I recommend changing username & password as mentioned in WordPress Brute Force Attack – Change Username/Login ID post.
It does help to prevent the hacker to gain access, but the attack caused another problem as it consumed a large amount of server resources. Plugins such as Brute Force Login Protection may assist you to block the IPs after a number of wrong attempts. However, some of the hackers have large numbers of IPs, from hundreds to thousands of IPs. I encounter this problem & really taxing my server resources similar to DDOS attack.
While looking for better alternative to solve this problem, I found out that if you are using Cloudflare, the request headers contain the country code of the visitor’s origin. The header I’m talking about is the “HTTP_CF_IPCOUNTRY”.
What you to do is to allow only visitors from certain country to access “wp-login.php” file by using “HTTP_CF_IPCOUNTRY” header and “.htaccess” file.
The example below is only allow visitors from United States & Canada. Change the country code in the third line to make it applicable to your locations.
<FilesMatch "wp-login.php">
RewriteEngine on
RewriteCond %{HTTP:CF-IPCOUNTRY} !^(US|CA)$
RewriteRule ^ - [F,L]
</FilesMatch>
WordPress blogging platform is well-known for its ease of installation even for beginner. The process should be very simple and should takes less than five minutes to complete.
This guide assume you are using Linux Hosting with cPanel & you have your own domain.
Step 1:- Add Domain to your cPanel Account
- You may skip this step is the domain already in your cPanel account.
- Log in to your cPanel.
- Click Addon Domains icon
- Enter your domain name, sub-domain/FTP Username & password.
- Remember the Document Root folder.
- Click Add Domain button.
Step 2:- Download & Extract WordPress Files
- Download the latest wordpress archive at http://wordpress.org/latest.zip to your computer.
- In cPanel account click on File Manager icon
- Browse to folder as per STEP 1 (5) above.
- Click Upload icon & upload the file download in (1) above.
- When done, select the file & click Extract icon.
- Browse to wordpress subfolder & click Select All
- Click Move icon & enter folder as per STEP 1 (5) above.
- When done, you may remove wordpress sub-folder.
Step 3:- Create MySQL Database
- In cPanel account click on MySQL Database icon.
- Enter database name & click Create Database button.
- On the same page, browse to the end & assign user to database created in (2) above.
- Click Add button.
- Tick All Privileges check-box & click Make Changes button.
Step 4:- Installation
- By using web browser, navigate to your domain.
- Click on Create Configuration File button.
- Click Let’s go button
- Enter Database name, username & password as per STEP 3. You may leave database host & table prefix as it is.
- Click Submit button.
- Click Run The Install button
- Enter Site Title, Username, Password, e-mail & tick Allow Search Engine to Index this site check-box.
- Click Install WordPress button.
- Installation done.
- You may log-in to WordPress back-end by Clicking Log in button.
- Start blogging!!
