WP login admin name incorrect send to another page or site

[idaryl]

Firstly a little overview - my site uses Wordfence (this is not the issue - just the reason for this to begin with)

-- Even if Wordfence is disabled this should still work. its just what brought this to light.

And... I have been getting numerous login attempts from different places and IP's using the hidden password recovery, or simply force loading names into the admin page.

I have seen a pattern emerging, whereas the popular name tries are: administrator, wpadmin, admin, wpadministrator, and a few others. Sometimes in the range of 150+ an hour, quite amazing, and annoying at the same time.

Wordfence does an abmirable job of blocking the attempts, however, I've noticed the same naming structure is applied repeatedly. And...Wordfence does its job, blocks the attempt, and themn proceeds to notify me about it - this has led to an inordinate amount of the exact same mail with the exact same login pattern.

Whew....!

So I figured I would add some kind of filtering to the login page by adding this ( part of the larger project - but its where it hanging up ) Not hanging up really, just only recognizes ONE name structure.....

public static function gtfo_admin_login( $login = '' ) {
    if ( 'administrator' != $login ) {
        return false;
    }

    wp_redirect( 'http://www.french-bukkake.com' ); // This is an example.
    exit;
}

So if some uses the name administrator, it forwards them to the (sorry-france) xxxx.page

I would like this to use some kind of array, where it uses -

"administrator" , "wpadmin" , "admin" , "wpadministrator" , "etc" , "etc"

Get the idea? and pushes the array items into

if ( 'array-here' != $login ) {
    return false;

So in effect, if different terms are used, it sends them elsewhere - except if the correct login/pwd combinations is used.

OR... possiblty even better it uses an external text file with each name on a new line - and do a call to it some thing like adding a var

$curr_admins = "". file_get_contents( 'https://siteaddress.com/a-dmins.txt' ) ."";

What do you think?

It would read the contents of the text file, regard it as an array and if it finds a match - BOOM - off goes the perpetrator ( I don't think bots can handle a return redirect, to try it again ). So presumably the login pattern should go down somewhat...

[AndreRet]

I had a similar issue recently, not sure if this will help in your case.

I noticed repeated hits trying to login as admin or other users. I went into my servers log file (not sure if you have access to this - chat to your server admin), which recorded the IP address of each attempt. There were something like 100-150 hits an hour in certain times from 4 different IP's which told me this is an attempt at a hack into the server. Luckily it was blocked via WP - I use Akismet and Vaultpress for security.

I then added these to my .htaccess file and had them blocked, no more warnings and countless e-mails. I can see their attempts in the log file but it is blocked before any of your security plugins gets initialized.

I checked the IP's on whois and it turned out to be located somewhere in the middle of nowhere. See code, this is what your .htaccess file should look like -

# BEGIN WordPress
# END WordPress
#Allow from all
#Allow from all
#Allow from all
#Allow from all
#Allow from all
Order deny,allow
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
Order deny,allow
Deny from 178.154.200.30
Deny from 178.154.244.64
Deny from 178.154.200.30
Deny from 178.154.244.64
Deny from 141.8.142.149
Deny from 213.180.203.11
#Allow from all

Hope this help as an easier solution. I DO HOWEVER LIKE YOUR SUGGESTION ON SENDING THEM OFF TO A HANKY PANKY SITE TO SATISFY THEIR CURIOSITY!!!!

[midnightmenu]

in_array() is what you need

$nope = array( "administrator", "wpadmin", "admin", "wpadministrator" );

if ( in_array( $login, $nope ) ) {
    return false;
}

[Matrimonial07]

you can also use FTP server
if you are using for onw hositng paln that you can access.

[Russell18]

Thanks for giving this info!

[Rio Vaks]

Are there other ways to solve this problem?

[raupsnics]

nice topic its my q