What does it mean when there are many POST requests to /wp-login.php in Apache logs?

Question

The messages are directed toward the WordPress site on my server. These are coming from the access_log, and I don't know if this should worry me or not.

There are well over a hundred lines of the same message spanning over a few seconds each time. If you don't know what I mean, here are the logs:

108.162.216.73 - - [22/Oct/2014:21:54:49 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
108.162.216.73 - - [22/Oct/2014:21:54:49 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
103.22.200.207 - - [22/Oct/2014:21:54:49 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
108.162.216.73 - - [22/Oct/2014:21:54:49 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
103.22.200.207 - - [22/Oct/2014:21:54:50 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
108.162.216.73 - - [22/Oct/2014:21:54:50 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
103.22.200.207 - - [22/Oct/2014:21:54:50 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
108.162.216.73 - - [22/Oct/2014:21:54:50 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
103.22.200.207 - - [22/Oct/2014:21:54:50 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
108.162.216.73 - - [22/Oct/2014:21:54:50 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
108.162.216.73 - - [22/Oct/2014:21:54:51 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
103.22.200.207 - - [22/Oct/2014:21:54:51 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
108.162.216.73 - - [22/Oct/2014:21:54:51 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
108.162.216.73 - - [22/Oct/2014:21:54:51 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
103.22.200.207 - - [22/Oct/2014:21:54:51 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
108.162.216.73 - - [22/Oct/2014:21:54:52 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
108.162.216.73 - - [22/Oct/2014:21:54:52 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
103.22.200.207 - - [22/Oct/2014:21:54:52 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
108.162.216.73 - - [22/Oct/2014:21:54:52 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
103.22.200.207 - - [22/Oct/2014:21:54:53 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
108.162.216.73 - - [22/Oct/2014:21:54:53 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
108.162.216.73 - - [22/Oct/2014:21:54:53 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
103.22.200.207 - - [22/Oct/2014:21:54:53 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
108.162.216.73 - - [22/Oct/2014:21:54:53 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
103.22.200.207 - - [22/Oct/2014:21:54:53 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
108.162.216.73 - - [22/Oct/2014:21:54:54 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
108.162.216.73 - - [22/Oct/2014:21:54:54 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
103.22.200.207 - - [22/Oct/2014:21:54:54 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
108.162.216.73 - - [22/Oct/2014:21:54:54 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
103.22.200.207 - - [22/Oct/2014:21:54:54 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"
108.162.216.73 - - [22/Oct/2014:21:54:54 -0400] "POST /wp-login.php HTTP/1.1" 200 3467 "-" "-"

I just did a count for all instances for these two IP addresses, and it was accessed at least over 100,000 different times, since the 22nd.

Solution 1

Someone is trying to brute-force your login page. HTTP POST requests are used for HTML form data, which in the case of a wp-login.php page will likely be the username/password form.

For WordPress specifically, you should read this wiki page, which mentions a number of useful steps to take and protect your instance, such as:

• not using the admin username
• picking a strong password
• using plugins to restrict login attempts at WordPress, Apache or server level
• htpasswd-protecting the page (with the help of a generator)

In any case, setting up fail2ban is something you should definitely consider. It will restrict the number of times a certain IP may try to log into your machine (e.g. over FTP, SSH, etc.).

Solution 2

It looks like brute force hacking attempts to get into the admin console of the WordPress site. I get these all the time on my WordPress sites. If you had a user called admin with the password 'pass', they would certainly have got in by now.

Install a security plugin that will block IP addresses after a certain number of login attempts. I use Wordfence.

Comments

[Naidim]

Those IP addresses seem to be coming from CloudFlare CDN servers in San Francisco and Japan, which is a bit weird.

[ceejayoz]

I'd expect that means the site is behind CloudFlare. There's probably an X-Forwarded-For header something like mod_rpaf could use, but it's not set up to

[ceejayoz]

You can (and usually do) point your entire domain at CloudFlare. That means incoming requests - GET and POST, dynamic or static - go through CloudFlare first, and thus would have their IPs.