Uncategorized,

Block wp-login and xmlrpc brute force attacks with CSF / DirectAdmin

https://github.com/tmiland/csf-custom-regex/blob/master/regex.custom.pm   Edit your /etc/csf/csf.conf like bellow: CUSTOM1_LOG = “/var/log/httpd/domains/*.log” We add the following rules to /usr/local/csf/bin/regex.custom.pm file. If it’s not there, create one. Then we add bellow code : # XMLRPC if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] “\w*(?:GET|POST) \/xmlrpc\.php.*” /)) { return (“WP XMLPRC Attack”,$1,”XMLRPC”,”5″,”80,443″,”1″); } # WP-LOGINS if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*]