-1

I want to make wp-login.php and/or wp-admin accessible only from one country. If I want wp-login.php access only from USA then my approach from .htaccess is like below

<Files wp-login.php>
order deny,allow
allow from 3.0.0.0/8
allow from 4.0.0.0/8
allow from 5.10.64.1/32
allow from 5.10.64.16/28
allow from 5.10.64.144/28
allow from 5.10.64.160/29
allow from 5.10.64.176/28
.
.
.
deny from all
</Files>

But this approach is not so clever one since server take too long time to even browse the page. My question is how to make wp-login.php accessable only from country specific so that it can't be access by other countries.

Another approach might be from mod_security by use of GeoLite City Database but I do not want to go there. Third approach might be using some plugins but I neither want to do that too.

All I am doing this is to prevent Brute Force Attack. If it is done from one ip then we can just block it, but if it is done from many ips then it result in server overload and Ddos. I am sure that all people in the filed of cyber security are facing similar kind of problems. What are your approaches?

  • Have you thought that you may be protecting against the wrong thing? A DDoS will use IP addresses from all over the world - and a large proportion will be within the US (based on current botnet stats) – Rory Alsop Sep 22 '14 at 10:33
  • FYI the question above was just an example and asking for what your thoughts are. Thank you for your answer but how about blocking access from blacklisted country like Ukraine ,Indonesia, Yugoslavia,Lithuania,Egypt,Romania,Bulgaria , Turkey,Russia. I think that will minimize the risk of being the victim of Ddos attack or may be getting hacked. what is your thought?? – Err0rr Sep 22 '14 at 10:40
  • It won't - that's the simple answer. Botnets are independent of countries and borders; and the stats do show a very large number will appear to come from IP's in the US. – Rory Alsop Sep 22 '14 at 11:31
  • don't follow US, it is just an example I am from Nepal and I can make wp-login.php only accessible from Nepal so that others can't hit on that page. At least that will work if client access admin page from within the country. Thanks for your time. – Err0rr Sep 22 '14 at 11:37
  • I don't think this is really what you are looking for, but something like fail2ban can help mitigate the impact of a brute force attack. However, a true DDoS can take down some really massive infrastructure (see Spamhaus attack at en.wikipedia.org/wiki/…) so don't expect it to be able to stop everything. – Jesse K Jul 8 '16 at 19:36
1

I read that you don't want to install plugins, but there is no other practical way to do this given your other restrictions. Wordpress actually has some good info I found after doing a little searching: http://codex.wordpress.org/Brute_Force_Attacks I don't have much experience with it so someone can probably suggest a specific plugin, but there is a list of them under the plugins suggestion you could test. This way a specific IP failing a specific amount of times will be locked out, which makes brute forcing impractical and shouldn't effect you at all.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.