Quantcast
Channel: WordPress.org Forums » [Wordfence Security - Firewall, Malware Scan, and Login Security] Support
Viewing all articles
Browse latest Browse all 33051

sgpark on "[Plugin: Wordfence Security] Block IPs of all 'admin' logins"

$
0
0

Are you saying that content writers have admin rights? Anyone with admin rights should be aware of any restrictions from typing an incorrect username/password combination.

No, I'm saying that content writers would be affected exactly the same way as admins--they would be locked out if they mistyped if the WordFence "Immediately lock out invalid usernames" option is checked.

At the risk of sounding 'hostile' why don't you back off the "one attempt and you're locked out" mentality? Be kinder, gentler and give them at least three attempts to login before locking them out. It is a fair compromise from the all or nothing stance.

Why? Because this:

If you examine the Wordfence logs you'll discover that nearly all of the hack login attempts are from bots.

You've answered your own question.

And you assume I don't already have a forgiving lock-down setup for bad typists. I do. But there's a reason why WordFence provides both options--to block invalid usernames and to allow only a certain number of bad logins--and there's a reason why WordFence allows them to work simultaneously: because they address different aspects of the problem. We're merely pointing out ways for the "lock out invalid usernames" functionality to be more useful to many people who run WordPress sites.

At first they use 'admin', but over time they try different user names--most of which are variations of poster's names.

I've probably managed over 30 WordPress sites in my time and currently manage 8 active ones, all with WordFence installed, and I've never seen this. The ones that get blocked for excessive login tries are always using "admin" or "administrator". Once, someone tried "guest".

Instead of sounding like a defensive WordFence developer, maybe you should try to understand why the people asking for this functionality want it. That's all I'm saying. Maybe some have already tried all the alternative approaches you think we haven't bothered to consider, yet we still think it would improve WordFence to add the ability to immediately block specific usernames--especially "admin" and "administrator"--instead of a catch-all "lock out invalid usernames".


Viewing all articles
Browse latest Browse all 33051

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>