5774 shaares
- Block all access "xmlrpc.php" and temporary block access to "wp-login.php" (by IP)
BEGIN Disable XML-RPC.PHP
<Files "xmlrpc.php">
Order Deny,Allow
Deny from all
</Files>
END Disable XML-RPC.PHP
BEGIN Limit Access to WP-LOGIN.PHP
<Files "wp-login.php">
Order Deny,Allow
Deny from all
Allow from 1.2.3.4
</Files>
END Limit Access to WP-LOGIN.PHP
-
Change default "admin" username if used
-
Set plugin to control login attempts
https://wordpress.org/plugins/loginizer/
(4. Password protect access to "wp-login.php" ... this doesn't work on my server, and it's apparently not the best solution)
BEGIN Password Protect WP-LOGIN.PHP
<FilesMatch "wp-login.php">
AuthUserFile /home/user/.htpasswd
AuthName "Authorized Only"
AuthType Basic
Require valid-user
</FilesMatch>
END Password Protect WP-LOGIN.PHP
BEGIN Disable XML-RPC.PHP
<Files "xmlrpc.php">
Order Deny,Allow
Deny from all
</Files>
