Here’s a guide on how to read WordPress hacking logs and how to respond to them.

In this article, we’ll explain how to view logs of WordPress hacking attempts—a feature of WordPress security plugins—and how to respond to them.

Recording and Viewing Logs of Hackers Who Launch Random Attacks on WordPress

Because WordPress is so widely used—with hundreds of millions of sites—it is targeted with specialized attack methods.

Hackers use automated attack tools that systematically target multiple vulnerabilities on WordPress sites one after another.

This type of attack is essentially a “hit-or-miss” approach, and if you review the attack logs, you’ll see that such attacks are being launched in massive numbers against all kinds of sites.
(Over 99% of these indiscriminate attacks fail.)

The [Free] WordPress: Malware Scan & Security Plugin [Malware & Virus Detection and Removal] includes a feature that detects hacker attacks.

Go to the plugin’s admin panel > Hack Monitor & IP Blocker tab > check the box next to “Enable Hack Monitor,” then click the “Save Settings” button at the bottom of the page.

How to Read the Hacking Log

About one to two months after enabling Hack Monitor, you may be surprised to see a large number of hacker attacks recorded—especially on sites that have been operational for a long time—butthis is something that can happen to any WordPress site, and since the likelihood that these attacks were successful (i.e., that the hacker managed to infiltrate the server and tamper with files) is low, there’s no need to worry excessively.

The hacking log table lists the detection date, the type of hacker attack (brute-force attack, vulnerability exploit, scan using hacking tools, etc.), the hacker’s IP address, the targeted files, and the data the hacker was sending.

Blocking Dangerous Hacker IP Addresses

If you click on the hacker’s IP address in the hacking log table, you can view how many reports have been filed regarding that IP address on www.abuseipdb.com—a database where security professionals worldwide share information about dangerous IP addresses—to see how many reports have been filed regarding the IP address that attacked your site.

For example, the IP address in the example below has been reported 703 times and is deemed to be 100% engaged in dangerous activity.
*You can also see that the IP’s location is listed as Pakistan.

Additionally, the hack log shows that this IP has launched four brute-force attacks.
It is best to completely block such IPs to reduce the likelihood of successful brute-force attacks, and I believe it is safe to block them completely for the time being.

You can completely block this specific IP using the “Block IP” button on the right.

Which attacker IPs should be blocked, and for how long?

At WP Doctor, we believe it is acceptable to permanently block an IP address if it has been the source of multiple similar attacks, is a www.abuseipdb.comでも大量の攻撃が報告されており, and is not a domestic IP address.

However, please note that if the IP address changes hands, it may no longer be used for hacking. Therefore, if you keep an IP blocked for years, there is a very rare chance that legitimate traffic (from that country using the same IP address as the one you blocked) might also be blocked.