Youdaman

Thanks @wpchefgadget, what you said makes sense re 2FA only sending on correct credentials. My apologies for this misunderstanding.

The only other odd thing then is that the notifications I receive for failed attempts are for existing usernames and not for more generic/obvious ones like “admin” for example. Could you please clarify why this might be? Is there a way for bots/hackers to retrieve a list of authors/users via a URL?

This plugin doesn’t know that I have 2FA installed. But it’s still claiming I have even more login attempts on accounts that are not receiving 2FA verification emails, so these claims are clearly false right?

I noticed that this plugin was claiming an increase in login attempts, even with XML RPC disabled and 2FA enabled, so I came here to post about it.

My reply isn’t necessarily unpleasant, it’s just stating facts and asking questions, and your response doesn’t make me feel I was incorrect in my suspicions about this plugin reporting fake login attempts.

You claim the developers have been helpful to you about this plugin, but all of your posts are in defence of criticism or questions about the legitimacy of the plugin — I don’t see any posts where you’re asking for the help you’re talking about.

If you are the developer, or even a friend of the developer, and the plugin is indeed giving false positives in order to upsell the premium version, and you’re actively assisting with covering that up, then you’re party to fraud.

Thanks for the reply. I understand that bots will keep attempting to hit my site.

I can see in the logs that the reported IP addresses are there, however they’re doing POST requests to /wp-login.php but I’m not sure that’s a valid attack vector.

Also, the point I was trying to make above re 2FA is that with every login attempt, the user receives an email with a verification code. There have been no such emails, so the login attempts haven’t actually been real login attempts — it’s just my /wp-login.php page is being spammed with POST requests.

So I’m saying there’s no legitimate login attempts as claimed by the email I received from the Limit Login Attempts Reloaded plugin. The “attempts” aren’t real. Which also leads to asking why would an actual hacker write a bot that doesn’t try to login.

The worst it’s doing is filling up my logs with pointless hits to a URL where it can do no damage — and if this is what Limit Login Attempts Reloaded is reporting as potential threats then it’s not being truthful.

That said I’m happy to be corrected if I’m wrong here, but it seems dodgy.