避免 WordPress 被入侵的方法

[kang000feng]

大家试试 /?author=1 , 不知道这文章提到的方法有多少人在用? 直接修改 user_nicename 不就行了? 大家都是怎么防范脚本暴力破解的?
http://www.weste.net/2013/4-28/90877.html

[nfroot]

PHP ：把访问 Wordpress 特征网址的直接拦截 IP 一周。包括登录页面。访问 404 页面的，对不起，判断一下特征，也是封 IP 。（根据不同特征封锁不同时间）

然后自己写一个登录页面或者对登录页面进行改造（其实挺简单的）

偶尔看下被封锁 IP 的列表，这玩意和潮汐一样，有时候多，有时候少，仅有少部分不好判断特征的没有封锁（想知道特征，翻翻网站日志就知道了），刚才看了下，居然封了这么多 IP （还是长时间的），平时都是很少的，一般 3-10 个这样。（英语乱拼的，别笑）

Blocked IP list

2016-11-09 16:17:20 NOW

Time start Time end IP address Time left(s)
2016-10-30 18:37:26 2016-11-09 18:37:26 93.72.174.43 8406
2016-10-30 21:39:18 2016-11-09 21:39:18 80.48.46.230 19318
2016-10-31 00:39:39 2016-11-10 00:39:39 91.218.208.60 30139
2016-10-31 03:08:06 2016-11-10 03:08:06 82.186.133.110 39046
2016-10-31 08:10:37 2016-11-10 08:10:37 31.43.63.183 57197
2016-10-31 13:51:15 2016-11-10 13:51:15 31.202.237.68 77635
2016-10-31 17:03:44 2016-11-10 17:03:44 185.49.169.2 89184
2016-10-31 20:06:54 2016-11-10 20:06:54 5.44.115.164 100174
2016-10-31 23:08:40 2016-11-10 23:08:40 31.154.9.174 111080
2016-11-01 04:55:26 2016-11-11 04:55:26 93.72.27.15 131886
2016-11-01 07:50:09 2016-11-11 07:50:09 109.238.234.158 142369
2016-11-01 10:55:03 2016-11-11 10:55:03 95.46.2.30 153463
2016-11-01 13:49:42 2016-11-11 13:49:42 109.167.56.233 163942
2016-11-01 16:58:18 2016-11-11 16:58:18 5.44.122.250 175258
2016-11-01 20:10:22 2016-11-11 20:10:22 94.141.61.100 186782
2016-11-02 11:22:23 2016-11-12 11:22:23 109.99.28.18 241503
2016-11-02 14:26:47 2016-11-12 14:26:47 5.44.119.79 252567
2016-11-02 17:25:50 2016-11-12 17:25:50 212.154.136.90 263310
2016-11-02 20:33:47 2016-11-12 20:33:47 185.25.116.217 274587
2016-11-02 23:45:55 2016-11-12 23:45:55 5.44.119.157 286115
2016-11-03 02:46:17 2016-11-13 02:46:17 178.23.201.184 296937
2016-11-03 05:29:59 2016-11-13 05:29:59 193.93.48.129 306759
2016-11-03 08:18:47 2016-11-13 08:18:47 193.254.37.95 316887
2016-11-03 14:30:51 2016-11-13 14:30:51 51.254.245.48 339211
2016-11-03 20:30:45 2016-11-13 20:30:45 81.57.18.173 360805
2016-11-03 23:36:02 2016-11-13 23:36:02 109.99.29.126 371922
2016-11-04 08:18:30 2016-11-14 08:18:30 195.214.198.143 403270
2016-11-04 11:08:08 2016-11-14 11:08:08 178.119.123.152 413448
2016-11-04 17:17:21 2016-11-14 17:17:21 109.0.35.150 435601
2016-11-04 20:24:04 2016-11-14 20:24:04 92.81.46.159 446804
2016-11-04 23:32:11 2016-11-14 23:32:11 82.200.135.210 458091
2016-11-05 08:58:58 2016-11-15 08:58:58 62.73.70.134 492098
2016-11-05 12:15:34 2016-11-15 12:15:34 91.237.242.253 503894
2016-11-05 15:19:40 2016-11-15 15:19:40 93.61.99.6 514940
2016-11-05 18:29:07 2016-11-15 18:29:07 109.61.92.103 526307
2016-11-06 00:46:37 2016-11-16 00:46:37 5.44.123.25 548957
2016-11-06 06:56:41 2016-11-16 06:56:41 90.182.190.75 571161
2016-11-06 13:10:37 2016-11-16 13:10:37 87.213.112.133 593597
2016-11-06 19:35:01 2016-11-16 19:35:01 5.44.115.206 616661
2016-11-06 22:57:07 2016-11-16 22:57:07 31.43.63.135 628787
2016-11-07 02:11:54 2016-11-17 02:11:54 92.85.147.138 640474
2016-11-07 14:11:00 2016-11-17 14:11:00 93.170.27.37 683620
2016-11-07 17:15:52 2016-11-17 17:15:52 194.184.32.226 694712
2016-11-07 20:26:10 2016-11-17 20:26:10 5.44.123.67 706130
2016-11-08 08:26:58 2016-11-18 08:26:58 178.19.181.137 749378
2016-11-08 11:27:34 2016-11-18 11:27:34 80.14.8.175 760214
2016-11-08 14:43:23 2016-11-18 14:43:23 109.99.29.50 771963
2016-11-08 17:49:26 2016-11-18 17:49:26 31.43.63.57 783126
2016-11-08 20:52:59 2016-11-18 20:52:59 62.95.49.253 794139
2016-11-08 23:53:53 2016-11-18 23:53:53 5.44.113.32 804993
2016-11-09 08:13:19 2016-11-19 08:13:19 85.203.80.206 834959
2016-11-09 11:15:02 2016-11-19 11:15:02 83.240.243.118 845862
2016-11-09 14:26:49 2016-11-19 14:26:49 5.44.122.114 857369
2016-11-09 15:37:59 2016-11-09 16:37:59 178.137.165.57 1239
2016-11-09 15:47:11 2016-11-09 16:47:12 176.8.88.110 1792
2016-11-09 15:52:56 2016-11-09 16:52:56 195.20.200.234 2136

[hqfzone]

实际上，用户名+密码=长密码，即使用户名暴露，密码够长也无所谓吧。