One of my sites has been hacked recently. To make it short, i had an old version of wisiya newsletters running wich was used to upload a few files in the wp-content directory. Since then a lot of things has changed regarding the security of this domain.
Among other things i implemented a worldwide blocking for wp-login.php via .htaccess as follows:
<Files wp-login.php>
Order deny,allow
Deny from all
Allow from my.own.static.ip.adress
</Files>
I've compared the accesslogs from before and after the implementation of this change and was pleased with the results. All unauthorized access attempts were blocked with a 403 response.
Until today.... Sucuri informed me via Email that someone must have gotten access to the login form and has sent a single login request to the server.
IP Address: 192.96.204.237
Notification:
User authentication failed: admin
This was after i changed the .htaccess file... As i'm still fairly new to apache and security in general, can someone explain to me how this is even possible?
Kind regards, Michael