Stop WordPress Crash From Brute Force Attack On WP-LOGIN.php

Just few days ago, my VPS at Hostgator has horrible crash. No matter how many time I restart the container, the memory usage is always reaching 101% and the server die.

After 2 hours struggling with the tech support, they finally told me that my server is under brute force attack. The hackers or bots are trying to hit on one of the WordPress website's wp-login.php file.

So WordPress was trying to do query to check the login and password. This process took over 100% CPU usage and try to hit on MySQL too many times. So the server went to cooling down mode.

There is no easy way to block those IPs. So the temporary solution is to stop the bot from hitting the wp-login.php file and summiting the login and password by password protecting the wp-loginl.php page. So it will prompt to enter extra login and password before login to WordPress.

This process add an extra file look up at Apache level.

Here is how it works.

1. Setup a hidden .wpadmin file above your website root. It's usually under /home/[username]/
2. Run SSH tool like putty.exe login to your web server as root.
3. execute the commentline: htpasswd -c .wpadmin [login name]
4. It will prompt you to enter password
5. Once you set the file you will need to add few lines of code to .htaccess file for each one of your WordPress installation

ErrorDocument 401 "Unauthorized Access"
ErrorDocument 403 "Forbidden"
<FilesMatch "wp-login.php">
AuthName "Authorized Only"
AuthType Basic
AuthUserFile /home/[username]/.wpadmin
require valid-user
</FilesMatch>

CodeIgniter Issues with .htaccess to display No input file specified. error

When running CodeIgniter on Apache 2.2 with PHP5, it display the following error when access url.

No input file specified.

System state:
Apache 2.2
PHP5.2 running as CGI mode with cgi.fix_pathinfo=1 according to PHPINFO().

Problems:
This problem is primary due to running PHP in CGI mode on Apache.

There are two solutions. No matter which one you choose, you will always have the same step 1.

Step 1: Obviously, PHP running under CGI mode has cgi.fix_pathinfo default to 1. Simpley open the /system/application/config/config.php file and make sure the following two options are set.

$config['index_page'] = "";

$config['uri_protocol'] = "AUTO";

Solutions 1:
Step 2: Create a customized PHP.INI file under the root directory of your site with the following line.

cgi.fix_pathinfo = 0;

Solutions 2:
Step 2: Go to .htaccess file and add question mark after index.php and before slash.

RewriteEngine On
RewriteCond %{REQUEST_URI} ^/system.*
RewriteRule ^(.*)$ index.php?/$1 [L]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.+)$ index.php?/$1 [L]

Personally, I choose the Solution 1 with PHP.INI. It seems to run faster.

Problem solved!