0

A Wordpress site I manage has the WordFence security plugin installed.

Legitimate users occasionally get blocked by the Brute Force protection aspect of the plugin, even though they haven't made any bungled login attempts.

When I look into the Live Traffic I see hundreds of invalid login attempts, mostly at /xmlrpc.php but some at /wp-login.php.

However, they don't look like hacking attempts, since they all use a blank username:

Mountain View, United States attempted a failed login using an invalid username "". https://my_domain.com/xmlrpc.php 5/2/2019 1:00:24 PM (22 hours 5 mins ago)

When I look up the IP addresses in WhoIs, it tells me that it's Google LLC.

Has anyone else come across this issue before?

Is it possible that some Google product, perhaps a Chrome browser tool, is inadvertently causing this issue?

Weirdly, when I blocked the IP address range of the attempts in WordFence, I was locked out of the site myself, even though my IP address isn't within the range.

PS: The site uses the W3 Total Cache plugin.

  • Chrome browsers do not connect from Google IP's, they use the IP address used by the machine running the browser. – Teun Vink May 8 at 6:54
  • 5
    To answer the question that you asked, yes, every website on the planet gets these all the time. – schroeder May 8 at 6:56
  • Botnet, malware, phishing contents all can be hosted by any cloud services. Besides AWS, Azure, GCP, etc, this also including web services such as github, dropbox, wordpress etc. – mootmoot May 8 at 7:07
  • Ok, thanks for the info, but I'm still confused as to why I was locked out of the site even though my IP address wasn't within the range. Is it possible that the W3 Total Cache plugin uses Google Cloud hosting and this caused that issue? – clayRay May 9 at 4:33
1

It sounds like something on your site is generating posts to your authentication page (perhaps a bug or misconfiguration) with no credentials. Your brute force protection is picking up on the Auth failures and locking users out.

Then when you visit the site you generated the same empty authentication posts and triggered the same brute force protection and locked yourself out.

So dig deep within your core or perhaps chrome Developer tools and determine where those auth posts are coming from.

  • Thanks, that makes sense. I'll investigate further along those lines. – clayRay Jun 14 at 5:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.