« first day (2113 days earlier)   

2:42 AM
@Darth_Vader, I am in total agreement with everything rarst said. In addition of WP can write to htaccess then any malicious code running in its context cn write as well, and you just don't want to be in that posisiton.
 
any suggestions?
 
This is something that should be handled at application level, or cache
as for 500. It means you have bugs in your code
 
err, maybe not 500 but invalid server requests
 
the rest are a grrrrr but every server has to be able to handle some amount of bots and dos
 
have to go look but I know for one it is 404
 
2:44 AM
how do you know it is a bot?
 
I'm just looking for bad and large number its from a bad bot
the requests, hold Ill find one
 
My generic reply is that looking at the logs for such a thing is a waste of time. You can't prevent people from trying to access "bad" urls. Just a waste of time trying to handle it as there is always some bot that will try a new combination
 
url/blog/wp-login.php requested 4 times; url/wordpress/wp-login.php requested 3 times; url/wp-content/plugins/user-role-editor/css/ure-admin.css all from the same IP along with 40 other similiar requests within a minute.
 
4 times in what time frame?
 
40 requests within a min
all of them looking for plugins
 
2:50 AM
and how often does it happen?
 
url/wp-content/plugins/form-lightbox/admin/css/style.css; url/wp-content/plugins/profile-builder/assets/css/rtl.css; url/wp-content/plugins/peepso-core/assets/css/style.css are a few others
about once a week I'd say. user agent is always undefined
 
well, accessing css files should not even register on your server CPU usage
 
I dont use any of those plugins
@MarkKaplun agreed but wouldnt you classify that as a bad bot?
 
not worth worrying about. Maybe someone intrested in finding out which plugins you use. There are several services that will do such a thing probably exactly in this way
 
also have one for wp-misc.php, what is wp-misc.php?
several php file requests
 
2:53 AM
this is the internet.... hard to define what is "bad"
 
after so many I block the IP =/
@MarkKaplun everything bad, till validated, lol... hostile environment.
 
the internet is an hostile enviroment all the time
The hard thing is to put the line from which point you actually start to care. What passes from background noice to something worth handling
 
so these are some PHP files: CHANGELOG.php, wp-checking.php, configbak.php, modx.php, xmlrppc.php, wp-config-sample.php, wp-content/plugins/500.php, wp-content/plugins/wpfoot.php, mko.php, modules/modules/modules.php. Would these be something to worry about?
 
blocking the IP works only against the good guys. Bad guys control many computers and can alternate IPs easily
 
ya that was why I just wanted to modify the htaccess for a given timeframe
so like block IP after so many bad requests with X timeframe then remove from htaccess
 
2:58 AM
for php file the answer is simple. You should block access to php on the wp-content and wp-includes directories
that is just a "good thing to do" regardless of the bot problem
 
that's with a htacces file in each of those folders.
 
or the main one, doesn't matter how
for login and xmlrpc it is best to move the end points, but this depends on your users
 
any good reads on this?
 
if you have many that are used to specific location it might be hard
the theme my login plugin should let you just put a login form in any page you want. Then you can block login.php at the htaccess level
this is a plugin I wrote - shop.marksw.com/downloads/rename-login-endpoint-plugin that should just move the end point. feel free to look at the code, there isn;t that much of it.
 
thanks, I will note that
 
3:05 AM
and even something for an XMLRPC shop.marksw.com/downloads/…
once the end point is changed and you know that your users know about it, anyone accessing those endpoint is by definition is a "bad guy"
this covers almost everything which is obviously bad actors, but you are still left with the URLs that might be proper url in the site.
 
3:34 AM
ah, animating SVGs with jQuery.. long night ahead, lol
 

« first day (2113 days earlier)