I've installed sshguard: sudo apt-get sshguard -y
and it works fine (I tried to "brute force" my own server and was blocked).
I desire to utilize sshguard
to defend form brute force attacks on WordPress. I've read the this tutorial and understood I need to do 2 things:
1) Totally disabling XML-RPC in WordPress.
Yet from the comments here I understand that totally disabling XML-RPC is an outdated, redundant operation in WordPress 3.x.x and so forth (and I use at least WordPress 4.7.x)
2) Put this location block somewhere inside Nginx conf (it wasn't clear to me from the article where exactly):
location "/wp-login\.php" {
access_log "/var/log/httpd/wordpress-logins.log";
}
Does indeed all one has to do to protect WordPress login from brute force attacks is to add this location block be to the global /etc/nginx/nginx.conf (inside the server block there)?
Or I might have misunderstood the authors intention.