Blocking WordPress Bruteforce Attacks on Nginx

If You Follow Nginx Official Documentation, Blocking WordPress Bruteforce Attacks on Nginx Will Be Quite Easier. We Can Stop Ping of Death For Example. Ping of Death is a kind of DDoS, we are not covering DDoS on IaaS in this article, it is already covered. Here are some easy and basic tricks, which most are not aware of.

Blocking WordPress Bruteforce Attacks on Nginx

Nginx Module ngx_http_limit_req_module limits the request processing rate. We need to add it on /etc/nginx.nginx.conf file on default Nginx apt version installation. Official method to limit the rate for an imaginary location named /search/ is this :

An example to limit requests towards wp-login.php file can be like this which unix socket settings :

Fail2Ban supports this feature of Nginx, so to fine-tune, we can install Fail2Ban :

then open the config file to adjust :

to this :

This is highly configurable, an example config :

/etc/fail2ban/jail.d/nginx-req-limit.conf should have this kind of settings :

You can run service ufw status command in Ubuntu to check whether ufw is running or not. Enable/Disable is this set :

You should cat this file – /etc/fail2ban/jail.local to check the settings :

We can configure /etc/fail2ban/action.d/ufw.conf file to control ufw. You should check the manual of Fail2Ban for better settings, the file somewhat looks like this :

At the end, if you try ApacheBench with a higher value against our domain :

Increase the value from 1 to few hundred times, it will reject. That is a basic way to flood. Never do these with others’ server, your IP might get blacklisted.