WordPress

Report login floods with a tiny must-use plugin, or straight from the web server log.

Every WordPress site gets login floods against wp-login.php and xmlrpc.php. This tiny must-use plugin reports an address once it fails ten logins within an hour. No settings page, nothing to update.

Install the plugin

1. Add your key to wp-config.php (optional, but reports count more with it):

   define('ISIPSAFE_KEY', 'sl_your_key_here');

2. Create wp-content/mu-plugins/isipsafe.php:

   <?php
   /**
    * Plugin Name: isIPsafe reporter
    * Description: Reports addresses with 10 failed logins in an hour to isipsafe.
    */
   add_action('wp_login_failed', function () {
       $ip = $_SERVER['HTTP_CF_CONNECTING_IP'] ?? $_SERVER['REMOTE_ADDR'] ?? '';
       if (!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
           return;
       }
       $counter = 'isipsafe_fail_' . md5($ip);
       $failures = (int) get_transient($counter) + 1;
       set_transient($counter, $failures, HOUR_IN_SECONDS);
       if ($failures !== 10) {
           return; // report once, on the 10th failure
       }
       $key = defined('ISIPSAFE_KEY') ? ISIPSAFE_KEY : '';
       wp_remote_post('https://isipsafe.com/api/v1/report?key=' . rawurlencode($key), [
           'timeout'  => 3,
           'blocking' => false,
           'body'     => [
               'ip'         => $ip,
               'categories' => 'web-app-attack,brute-force',
               'comment'    => 'WordPress: 10 failed logins within an hour',
           ],
       ]);
   });

Must-use plugins load automatically; there is nothing to activate. Only use HTTP_CF_CONNECTING_IP if your site really is behind Cloudflare, otherwise anyone can set that header. Remove it from the first line if not.

Without touching WordPress

From the web server log instead. Real users post to the login page a handful of times; bots post hundreds:

grep 'POST /wp-login.php' /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | awk '$1>20{print $2}' | xargs -r -I{} curl -s "https://isipsafe.com/api/v1/report?key=$ISIPSAFE_KEY" -d ip={} -d categories=web-app-attack,brute-force -d comment="wp-login.php brute force"

Need a hand?

If something here does not work with your version of WordPress, or you have improved it, tell us. We update these pages with what people send.

WordPress and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.