Imunify360 and wp-login attacks

Imunify360 and wp-login attacks
It seems that lately Imunify360 has been very bad at blocking wp-login.php attacks. Earlier their graylist blocked these quite nice but now it seems that lot of bots come through. They have a modsecurity rule "Wordpress Bruteforce RBL remote check", but that does not really do anything.
++++++++++++++
list of top cheapest host http://Listfreetop.pw

Top 200 best traffic exchange sites http://Listfreetop.pw

free link exchange sites list http://Listfreetop.pw
list of top ptc sites
list of top ptp sites
Listfreetop.pw
Listfreetop.pw
+++++++++++++++

Have anyone else experienced the same? I think our old setup with CSF and Comodo WAF was more effectivce in blocking these attacks.

Best thing would be to redirect all users to Capcha when going to wp-login.php page.
We have recently switched to using RBL for blocking wordpress brute force attacks. We have seen several people who don't use web shield CDN proxying being affected - because they used CDN and no mod_remoteip. Maybe it is your case.
Otherwise, could you contact our support, so they can determine what is causing your issue.
Igor Seletskiy
CEO @ Cloud Linux Inc
http://www.cloudlinux.com
CloudLinux -- The OS that can make your Shared Hosting stable
CSF on Cloud Linux will block wp-login attacks quite effectively. It's quite common to deploy CSF on Cloud Linux servers

In fact some providers deploy CSF and Imunify360 together on Cloud Linux servers, so it'd be easy to block the wp-login attacks using CSF and use Imunify360 as an additional layer of protection.
@3FRSB recently posted a way to do just that using CSF.
We have recently switched to using RBL for blocking wordpress brute force attacks. We have seen several people who don't use web shield CDN proxying being affected - because they used CDN and no mod_remoteip. Maybe it is your case.
Otherwise, could you contact our support, so they can determine what is causing your issue.
How effective is Imunify360 at blocking WP brute force attacks when Cloudflare is involved?

For example, lets say a client is using Cloudflare directly (not through the hosts cPanel plugin) and using Cloudflare's nameservers. So the host does not have the ability to manage the Cloudflare account in order to block the original/real IP address as they would if the client were using Cloudflare from the hosts cPanel.

hosting your own baby shower
hosting 5gb
g5u.pw
1 domain drive
downloadmygifts.com
www.thinklinx.com
hosting 5 gb
domain functional level

So while mod_cloudflare or mod_remoteip will allow the connection to be logged as the real IP of the connecting machine, the connection is still coming from the Cloudflare IP address.

The host obviously cannot block the Cloudflare IP address because it would affect all clients using Cloudflare on that server, but cannot block the offending real IP either because the attack is technically coming from the Cloudflare IP and not the real IP of the attacker.
It is fully effective as long as you either:
1. enable WebShield CDN proxy
2. OR setup mod_remoteip and correctly pickup cloudflare headers / real IP

We are blocking WP brute force attacks using modsec/RBL -- and not blocking them on firewall level.
Igor Seletskiy
CEO @ Cloud Linux Inc
http://www.cloudlinux.com
Thank you @iseletsk that makes sense.
I think that an "under attack" button would be great. When turned on, every request to wp-login.php would go though captcha. Would this be possible? Or can it already be done with some custom rules?
With CloudFlare active, you could have a page rule or .htaccess to block traffic towards /wp-login.php directly (and also with BIC - Browser Integrity Check), then use wps-hide-login plugin to change the actual login URL. Then every hit towards /wp-login.php you can just deny (but not block)
From my Wordpress experience, the best practice to avoid wp-login attacks is to alter the login url as @zacharooni have mentioned.
Even though if you have a firewall, it will block those requests, but "if" - for whatever reason- they broke through your firewall, the admin login URL will be a whole different level of challenge.
When it comes to shared hosting environment, users do not know or do not care about this so the best protection will always be from the server level and not just via firewall alone.
all the user has to do is ensure that they run something like wordfence. This doesnt help overuse of server resources in tackling these unwanted attacks obviously, however, i get far more from mail server probes than from websites.
How effective is Imunify360 at blocking WP brute force attacks when Cloudflare is involved?

For example, lets say a client is using Cloudflare directly (not through the hosts cPanel plugin) and using Cloudflare's nameservers. So the host does not have the ability to manage the Cloudflare account in order to block the original/real IP address as they would if the client were using Cloudflare from the hosts cPanel.

So while mod_cloudflare or mod_remoteip will allow the connection to be logged as the real IP of the connecting machine, the connection is still coming from the Cloudflare IP address.

The host obviously cannot block the Cloudflare IP address because it would affect all clients using Cloudflare on that server, but cannot block the offending real IP either because the attack is technically coming from the Cloudflare IP and not the real IP of the attacker.

Thanks!
If the info is of any use (not an expert):

My WordPress website, using Cloudflare tested.
Testing with Owasp ZAP passive scan, it got blocked by WordFence, not by the hosting server.
Though it could be that WordFence just had a bit lower blocking threshold (fewer failed login attempts).
Mostly harmless?
When it comes to shared hosting environment, users do not know or do not care about this so the best protection will always be from the server level and not just via firewall alone.
That is true. Sometimes customers will install plugins like WordFence but using plugins like that can cause high resource usage for their own account thus slow their own sites down. It is best protected at the server level i.e have security use resources from the server itself, not custom plugins making customer hit LVE limits quicker.

Quote Originally Posted by goannawebsites  View Post
all the user has to do is ensure that they run something like wordfence. This doesnt help overuse of server resources in tackling these unwanted attacks obviously, however, i get far more from mail server probes than from websites.
That is not that good. It can slow your own sites down due to hitting LVE limits. Let software at server level take care of it like CSF+Comodo or Imunify360.
HostXNow Cloud Hosting - Powered by cPanel.
HostXNow Reseller Hosting - Powered by cPanel/WHM.
Let software at server level take care of it like CSF+Comodo or Imunify360.
From the first post:
Quote Originally Posted by HostingSE  View Post
It seems that lately Imunify360 has been very bad at blocking wp-login.php attacks.
It's that he's complaining about.
 Show your support for everyone affected by the Australian bush fires, and those fighting them
We do something similar adding a captcha challenge to the WP login URL.
This solution has proved us to be a very effective and simple solution.
Unfortunately some users setup Cloudflare on their own without notifying us.
WP Hide is a popular solution to hide login url. Only known users, which is mostly a single admin user will know the login URL.
Default login URL will be a 404.
BountySite: Website Time Machine with Offsite Security Scanning
Adding Value and Revenue to your Hosting