Massive brute force attack on WordPress sites
These days different WordPress blogs are victims of brute force attacks to access the administrator panel (through the login panel wp-login.php) and if they manage to access they inject malicious code (malware) into the theme you are using.
The brute force attack comes from a network of botnets from various locations around the world and uses “admin” as a user combining it with a multitude of passwords. At the moment more than 10,000 different ips have already been located. This attack can be an inconvenience if you have chosen a very simple password or even very small servers can saturate the server.
How to protect WordPress against brute force attacks.
The simplest and most efficient method is to choose a complex password that uses special characters . A good recommendation when selecting a password is to use specific symbols of some language that do not exist in English, for example our dear Ñ. The choice of these symbols is because they are not found in the English character set that is used by the vast majority of brute force programs.
The solution for CloudFlare users is automatic (including free service) as they have taken real-time measures to prevent these attacks. If you use CloudFlare in your WordPress you can sleep peacefully because you are protected, but you are a CloudFlare user it may be a good time to be.
A third solution (in my opinion the least effective) is to use a WordPress plugin such as Wordfence and configure it correctly. In this case, as it is an attack on the login script, you have to pay special attention to the Login Security Options options and configure the block after several incorrect login attempts. Personally I do not like the plugin option (although Wordfence is a great security plugin) because I do not like to overload the blog with plugins, but it is also true that any security investment can save us more than a dislike.