Introduction
WordPress websites commonly receive repeated and automated login attempts targeting the wp-login.php page. To reduce unwanted login traffic and improve website security, ModSecurity can be configured to restrict access to the WordPress login page based on the visitor’s country. This allows website administrators to permit login access only from trusted countries while blocking requests originating from other locations. In this example, access to wp-login.php is restricted to users from India, while requests from other countries are blocked with a 406 Not Acceptable response.
Prerequisites
ModSecurity must be installed and enabled on the Apache server. GeoIP/GeoLocation support must be available and configured for ModSecurity. Root or administrative SSH access to the server is required. Apache configuration files must be accessible for modification. A valid ModSecurity rule ID should be used to avoid conflicts with existing rules. Take a backup of the Apache/ModSecurity configuration before making changes.
Implementation:
1. Open the domain configuration file. By default, the location will be /etc/apache2/sites-enabled/default
vi /etc/apache2/sites-enabled/default
2. Append the code below
<IfModule mod_security2.c>
SecRule REQUEST_URI "wp-login.php" "chain,id:2018,log,msg:'Blocking %{geo.country_code}' - Suggested by PheonixSolutions.com"
SecRule REMOTE_ADDR "@geoLookup" "chain"
SecRule GEO:COUNTRY_CODE "@streq IN"
</IfModule>
Where,
Secrule – ModSecurity rule
Request_URI – URL to which the rules apply
chain – It indicates that there will be continuation of the rule to the next line.
id – Unique Mod_security reference ID
log- It tells Apache to log the message
msg – Message should be logged in the log
GEO:COUNTRY_CODE – Country code
streq – String Equal to
IN – India. If we want to allow access from other countries, then mention the two-digit code of the respective country
3. Check the syntax error
apachectl -t
4. Restart the Apache server.
service apache2 restart
Now, if any user accesses wp-login.php from India, they will see the login page. If the user accesses wp-login.php, then they will get a “406: Not acceptable “ page.
Conclusion
Using ModSecurity to restrict access to the WordPress wp-login.php page based on the visitor’s country provides an additional layer of security against unwanted and automated login attempts. In this configuration, only users from India are allowed to access the login page, while requests from other countries are blocked with a 406 Not Acceptable response. The rule can be customized to allow access from other required countries based on the website’s business and security requirements.
FAQs
1. Can I allow access to wp-login.php from multiple countries?
Yes. The ModSecurity rule can be modified to allow multiple country codes based on the website’s requirements.
2. What happens when a user from a blocked country accesses wp-login.php?
The request is blocked by ModSecurity, and the user receives a 406 Not Acceptable response.
3. Can I change India to another country?
Yes. Replace the IN country code in the ModSecurity rule with the required two-letter country code.
Related Articles
Installing ModSecurity with OWASP CRS on Apache (Ubuntu)
Talk to our experts
Looking for the right technology solution for your business?. Our experts can help with web hosting, domain registration, DevOps and cloud, software development, web applications, mobile applications, and enterprise solutions. Get in touch with our team here.