Instructions of how to protect Wordpress from bots and hackers.

Five important steps to protect your Wordpress website from bots:

1) Change your admin login path. So nobody can find it.

2) Disable direct access to .php scripts on your website. Only the main "index.php" file should be available for everyone.

3) Block access to "xmlrpc.php" file if you don't use it.

4) Don't save backup files in the website root directory. Someone can find and download it.

5) Check regularly website raw access log. (few times per year is enough)

Steps in details:

1. Change your admin login path.

Add the following code:

to your .htaccess file:



to the "functions.php" file of your theme (or create a custom plugin):



Replace "admin22" with your custom path.


NOTE: Be careful with the ".htaccess" file! Any error in it will make your website not accessible.
Save a back up of it before changing.


After changing your admin login path don't think that bots will never find the new path.

So install some simple captcha plugin like:
https://wordpress.org/plugins/captcha-code-authentication

Or some simple plugin that can limit number of login attempts like:
https://wordpress.org/plugins/limit-login-attempts/

Or without a plugin:
https://stackoverflow.com/questions/25836668/wordpress-limit-login-attempts-without-plugins



There are also other different ways to protect you dashbord:

1. To change the admin path so nobody can find it.
That would be the best way. But wordpress requires string find-replace operations to make it work.
So it will affect website performance.

2. To rename the "wp-login.php" file.
You can find some instructions on this page:
https://stackoverflow.com/questions/45430027/changing-wp-admin-url-to-something-else

Also you will need to add some code into the "functions.php" file of your theme:
https://wordpress.stackexchange.com/questions/418230/unable-to-logout-correctly-after-wp-login-file-was-modified

3. To add a second layer of login, password protection with Basic Auth in htaccess.

You can find code examples on this page:
https://kb.planethoster.com/en/guide/protecting-your-wordpress-with-double-authentication-via-htaccess/
To allow logout from woocommerce:
https://wordpress.stackexchange.com/questions/352829/basic-auth-htaccess-on-wp-login-but-allow-logout-from-woocommerce

4. To limit access to admin dashbord by IP address:
https://stackoverflow.com/questions/51495232/how-can-i-restrict-access-to-the-wordpress-admin-login-page-by-ip-address-with


--- Sugested way: ---

If you need a stronger protection modify your login page.

Many websites were hacked just because they have exactly the same login page.

Just try to add a third field to the login page and no one bot or hacker will know what to do with it.

2. Disable direct access to .php scripts

In the access logs you can see that bots trying to call different files in the root folder like:
123.php
post.php

Also they are trying to access some plugin files directly.

You can deny access to them in the .htaccess file:


I have found it on this page:
https://stackoverflow.com/questions/25982250/htaccess-block-all-php-file-in-certain-directories


If some plugin requires direct access to its php file.
You can allow access to it by adding the line:

before the line:

3. Block access to "xmlrpc.php" file

"xmlrpc.php" file is needed to connect wordpress to other systems.
Bots are also interested in it. Because it is a way to get access to your website.
If your website is not connected to other systems. Or they don't connect via this file.

You can block access to it in .htaccess file:



The code is from this page:
https://wordpress.stackexchange.com/questions/219643/best-way-to-eliminate-xmlrpc-php

4. Don't save backup files in the website root directory.

You will see from access logs that bots regularly check for back up files like:
backup.zip
website_backup.zip
database_08.03.22.sql.zip

So don't save your back up files in the website root where everyone can access it.

5. Check regularly website raw access log

Raw access log should be available in your cpanel or hosting administration panel.
It is long text file that contains only:
IP address, date, request type, requested URL, responce code, size of transmitted data, referrer and some other info.
Every line is a new request to the server.

A normal visitor makes many requests to load a single page.
Because it needs to load css styles, javscript scripts, images...

A bot makes just one request.
Because it does not need page styles and images.

Example of direct access from 61.136.144.96 :


If you have protected this part of your website the server response code will be 403 - forbidden or 404 - not found.
Response - 200 means that server still allows to access this script.

Long Story:

Hackers cannot check millions of wordpress websites.
They use bots (small programs, scripts) for it.
Bots check if a website has a back door accessible and record it.
Then another smarter program will try to break the back door.
If the back door is already open they will notify hacker or another programm that will add spam to your website.
Smart programs can add spam on such rare pages so the website owner will not notice it.
Or will use website to send spam to other people by email.

It is why the first step is to protect website from bots.

If your website is not new and already appears in google search results.
Bots also can find it.

Check the raw access log of website.
You will notice that some IP addresses are listed just once.
And they tried to access some .php script directly without loading page styles and images.

It is why you should protect .php scripts from direct access.

Now check the access logs more and you will see how bots trying to access some strange file:
wp-content/plugins/plugin_name/pub/static/upload_files.php
Why do they try to access it?
Because they know that file is a well known back door.

It is why you should check access logs regularly (few times per year is enough).
To see what they are looking for on your website and protect it.

Conclusion:

Safe life with Wordpress is possible. If you allow access only to the front-end and only for visitors not bots.