htaccess help

[rst]

My site keeps getting hits for wp-login.php file . I guess its connected to wordpress hack of some sort.  Is there a way to block these hits in htaccess ?

 

thank you

[abdus]

Add this to your .htaccess file

  # -----------------------------------------------------------------------------------------------
  # 12. Access Restrictions: Keep web users out of dirs that begin with a period,
  # but let services like Lets Encrypt use the webroot authentication method.
  # -----------------------------------------------------------------------------------------------

  RewriteRule "(^|/)\.(?!well-known)" - [F]

  # Block all requests to WP specific files starting with wp- 
  RewriteRule wp-.*\.php$ - [F]

 

[rst]

thanks, i added this to htaccess, but still get a 404 error page, that loads

[Zeka]

Hi @rst

You can find a lot of recommendations from Ryan how to optimize such cases

https://processwire.com/blog/posts/optimizing-404s-in-processwire/

[rst]

thank you!

[abdus]

Where you put the rule matters. Let's try it differently. Remove the previous line and find 15. Access Restrictions section, and change its end from this

  # Block all http access to the default/uninstalled site-default directory
  RewriteCond %{REQUEST_URI} (^|/)site-default/
  # Block all requests to WP specific files starting with wp-
  RewriteRule ^.*$ - [F,L]

into this

  # Block all http access to the default/uninstalled site-default directory
  RewriteCond %{REQUEST_URI} (^|/)site-default/ [OR] # <------- REMEMBER TO ADD [OR] FLAG
  # Block all requests to WP specific files starting with wp-
  RewriteCond %{REQUEST_URI} (^|/)wp-.*\.php$
  # If any conditions above match, issue a 403 forbidden
  RewriteRule ^.*$ - [F,L]

This one blocks all requests ending with wp-xxxx.php and works great on my setup. (Previous method works, too)

[rst]

i did the 404 redirects from the link above, and that works, thank you

[flydev]

Here is an alternative of editing the .htaccess file. You could use Jumplinks from @Mike Rockett and manage all of your 404 hits easily (as well all others redirects needed).

 

OT: about the wp-login itself, you could create a page and a template for this, reproduce the WP login form and play a bit with the "hackers" by giving them a nice memes on login submission

(last example: https://rockett.pw/jumplinks/examples)