Ok, LOCK might be too strong of a word. This little script will NOT make your WordPress installation more secure in any meaningful way. However, it will stop those brute force attacks against your login page, thus decreasing the server load. I wrote this little script a few days ago after noticing unusual server load on my web server, and after analyzing server logs, I found that there where close to 30 different bots trying to brute force their way into the WordPress installation. There are many plugins that will lock the login page out after several incorrect logins, but that still means that the bot will connect to the server and cause it to do work, like running PHP, looking up stuff in the Database, etc. Times that by 30 and you have a lot of parasitic load on your server.
This WordPress blog is a single user blog. This particular technique will not work for a blog with multiple editors and contributors. Basically I made a script that allows you to disable or re-enable the wp-login.php file.
Installation
- Get the script from GitHub.
- Copy wpLock.php to your WordPress install directory
- Rename to something other than wpLock.php. This is security by obscurity, so use something obscure :).
Using
- Go to
www.yoursite.com/wpLock.php. You of course remembered to rename wpLock.php to something else, right? - Click the Unlock Link, the page will reload and tell you that WP is now UNLOCKED.
- Login into WP normally and use it. Logout when done.
- Go back to
www.yoursite.com/wpLock.php, and click the Lock link.
Updating Word Press
When updating WordPress, make sure that the login page is unlocked, so that the login.php file can also be updated.
Final Notes
Released under the MIT License. Use it, love it, fork it, make changes, send pull requests. Enjoy!