Checking my logs during the past few months there has been a very noticeable increase in the number of visitors to my website who attempt to access "/wp-login.php". These visitors usually come out of the blue without having visited any pages before this.

 

Now, I don't use WordPress (I assume that is what the wp part means), and don't have any log-in page at all on my site, so they all receive a 404 error and go away. No harm done.

 

But what is the reason for it all? Has accessing "/wp-login.php" become a favourite method of attack? And what if I did have a /wp-login.php page?

 

Thanks for any insight.

... Martin

 

 

 

It's the first place a hacker will go to try and access a Wordpress site. If you use Wordpress and have good security on your site and server then you will be in a pretty safe place. It will never be 100% secure but it will deter the bots.

Thanks, fisicx, and what you say makes a lot of sense to me (though I know nothing about WordPress).

 

I have noticed two things about these access attempts. One is that they almost always use the non-SSL address (http) for my site, even though my site is on an SSL server and their request is automatically redirected to my https address. The other is that they almost always use the domain name in the address, rather than my dedicated IP address. This makes me think that my domain name is on a list somewhere they have picked up, instead of simply using a script to go incrementally through a numerical range of IP addresses. Does that make sense to you?

 

Have to admit that I am pretty naive about these things but am trying to draw logical conclusions from the situation. If that is possible ... ;-)

... Martin

That's exactly what they are doing. The bots just scrape domain names from wherever and run the script. I had a period a few months back where I was getting about 400 attempts to hack a site per day. They all got blocked and it's now down to a handful of attempts per week.

Wow, 400 a day! Guess I have to be thankful that my site gets only 3, 4, 5 a day. Thanks for your insight, fisicx, and you have shown me that I will have to learn to expect this sort of thing. It's a wild world! Thanks again for all your comments and I am grateful for your wisdom and experience. This is certainly a learning experience for me. :-)

... Martin

On a bad day, it's not unusual to see an attempt every few seconds and when they find a genuine wp-login page, that can ramp up to several per second.

 

I know you don't have a login page but for anyone reading this that does, Fail2Ban is worth looking into. It monitors the hosting log files for failed logins, malicious activity, etc so it's independent of the hosted application.