Simple code to detect brute force attacks on WordPress and block its IP for 1 hour.

Here is a simple PHP code (in functions.php) that detects a brute force attack on wordpress and blocks that IP for 1 hour.

Brute force attacks can sometimes slow down a site significantly!

A brute force attack is an attack that attempts to log into a site using a dictionary of tens of thousands of passwords.
This attack causes excessive access to the site and database, which can slow down the site and create huge log files.

Brute force attacks can be detected by the server log file or by a security plugin, since excessive access to wp-login.php is recorded in the server logs.

A simple program to block brute force attacks

Here is a simple PHP code to detect and stop a brute force attack. (It works if you put it in functions.php)

add_action( 'login_init', function() {
    if ( $_SERVER['REQUEST_METHOD'] === 'POST' ) {
        $password = $_POST['pwd'] ? '';
        if($password = "123456"){
$user_ip = $_SERVER['REMOTE_ADDR'];
set_transient( 'blockip_'. $user_ip , $user_ip, HOUR_IN_SECONDS );
}
    }
});
add_action( 'after_setup_theme', function() {
    $user_ip = $_SERVER['REMOTE_ADDR'];
if(get_transient( 'blockip_'. $user_ip )==$user_ip){
wp_die("Access to the site has been blocked for 1 hour"); }
}
});

This code blocks a hacker who has made a brute force attack on the wp-login.php login screen for one hour.

In add_action( ‘login_init’), we check if the password string sent at login is 123456, the most common password in the dictionary of brute force attacks used by many hackers, and if it is, we add the IP (the hacker’s computer If so, the IP (address of the hacker’s computer) is stored in transient, which is maintained for only one hour.

Then add_action( ‘after_setup_theme’) retrieves the IP of the user accessing the site, checks if there is a corresponding transient value, and if so, blocks access to the site. (The transient will disappear automatically after an hour, so you will only be blocked for one hour.)

If you really use the password 123456, you will not be able to log in anymore. 123456 is part of the dictionary of many brute force attacks, so we recommend that you never use it!

This code is simple and may work if you have a brute force attack on wp-login.php and are having trouble with excessive access. However, some brute force attacks can also be used to gain excessive access to xmlrpc.php. For more comprehensive brute force attack detection and defense, we recommend the use of a security plugin.