Prevent Brute force attacks on WordPress with SSHguard

Question

I've installed sshguard: sudo apt-get sshguard -y and it works fine (I tried to "brute force" my own server and was blocked).

I desire to utilize sshguard to defend form brute force attacks on WordPress. I've read the this tutorial and understood I need to do 2 things:

1) Totally disabling XML-RPC in WordPress.

Yet from the comments here I understand that totally disabling XML-RPC is an outdated, redundant operation in WordPress 3.x.x and so forth (and I use at least WordPress 4.7.x)

2) Put this location block somewhere inside Nginx conf (it wasn't clear to me from the article where exactly):

location "/wp-login\.php" {
  access_log "/var/log/httpd/wordpress-logins.log";
}

Does indeed all one has to do to protect WordPress login from brute force attacks is to add this location block be to the global /etc/nginx/nginx.conf (inside the server block there)?

Or I might have misunderstood the authors intention.

Answer 1

Does indeed all one has to do to protect WordPress login from brute force attacks is to add this location block be to the global /etc/nginx/nginx.conf (inside the server block there)?

More or less.

You add the line to nginx.conf which indicates that every time someone tries to access a url that looks like the login page, the request gets logged to disk. SSHguard is going to monitor and analyze the log file continuously and presumably update iptables if the number of hits to that page from a specific IP exceeds a certain threshold.

XML-RPC as implemented in Wordpress can only be described using strings of obscenities. It's critical to a lot of third-party plugins so disabling it will break those, but leaving it enabled will also open you up to additional bruteforce authentication attempts. If you're using Jetpack or similar I'd recommend you add /xmlrpc\.php to nginx.conf as well and tweak SSHguard so it monitors page requests there too.

One problem you'll quickly come up against after doing all this is that only the laziest of attackers bruteforce from a consistent IP address. You'll quickly find a misappropriated IoT/botnet bruteforcing you from a variety of IP addresses over time to circumvent your defenses, but it's a worthwhile step to at least stop basic attacks.

Answer 2

What Tom is implying in his comment on that question is that there are no issues with XML-RPC anymore. I cannot verify that claim.

In any case if you don't use it you can just shut it down anyway to be on the safe side!