Community Q&A:
wp_admin brute force hacks
Yesterday I could not login to my wp dashboard. I was informed my site had a hack attempt or was hacked. I was directed to a page with options for protecting it. This is what I chose.
ErrorDocument 401 "Denied"
ErrorDocument 403 "Denied"
<FilesMatch "wp-login.php">
AuthType Basic
AuthName "Secure Area"
AuthUserFile "/home/example/.htpasswds/public_html/wp-admin/passwd"
require valid-user
</FilesMatch>
This morning I could not get into my site again. Error Code 500. I called in to get help and the tech needed my user name and password for my wp_admin. I did not have one nor do I remember creating one. He had my normal wp login info, but it did not work for him either. He took the password off the directory and we were both able to log into wp dashboard ok.
I looked back into my htaccess folder to check to see if everything was ok, and found part of the code missing:
ErrorDocument 401 "Denied"
ErrorDocument 403 "Denied"
<FilesMatch "wp-login.php">
AuthUserFile "/home/example/.htpasswds/public_html/wp-admin/passwd"
</FilesMatch>
So,can anyone tell me what happened?, Do I need to replace the code again or what?
ErrorDocument 401 "Denied"
ErrorDocument 403 "Denied"
<FilesMatch "wp-login.php">
AuthType Basic
AuthName "Secure Area"
AuthUserFile "/home/example/.htpasswds/public_html/wp-admin/passwd"
require valid-user
</FilesMatch>
This morning I could not get into my site again. Error Code 500. I called in to get help and the tech needed my user name and password for my wp_admin. I did not have one nor do I remember creating one. He had my normal wp login info, but it did not work for him either. He took the password off the directory and we were both able to log into wp dashboard ok.
I looked back into my htaccess folder to check to see if everything was ok, and found part of the code missing:
ErrorDocument 401 "Denied"
ErrorDocument 403 "Denied"
<FilesMatch "wp-login.php">
AuthUserFile "/home/example/.htpasswds/public_html/wp-admin/passwd"
</FilesMatch>
So,can anyone tell me what happened?, Do I need to replace the code again or what?
ANSWERS
|
0
|
Hello, Thank you for contacting us about issues logging into your WordPress dashboard. Our WordPress article on Brute force attacks contains several options. It looks like you password protected your directory, which blocked you out. Then, when you removed it, you were able to regain access. If you want the admin section secured, I recommend password protecting the directory via cPanel, which allow you to create a username/password. There are also many security plugins available for WordPress, that can help secure your site. Let us know if you have any further questions. Thank you, John-Paul |
Want to share this Question?
Tweet
Help Center Login
Related Articles
It looks like there are no related articles.
Would you like to ask a question about this page? If so, click the button below!
