I have found a WordPress plugin which looks quite interesting. I am currently evaluating how it works, and whether it makes any difference. What it does is blocks access to your site from countries that are not listed as acceptable.
Why would you want to do that?
Hackers control things called Bot Nets. They are computers based all around the world. In many if not most cases the owners of those computers are unaware that they have been infiltrated. What a hacker may do with a compromised server is use it to launch attacks on other sites and servers.
With the security used on your sites there is a mechanism which will detect failed logins. If more than three failed logins occur over a set period (generally 30 minutes) the device that is attempting to login will be blocked for a period of time.
At the point the login is blocked another computer comes on line and attempts to login too, and so the process repeats itself. It is called a Brute Force Attack, they occur all of the time, and sometimes for extended periods of time.
The hacker tries to guess the username and the password through an automated process. They often use password libraries that contain statistically proven passwords used by people, and sometimes they do get in. In our case we are all using very complex passwords unless you have changed it to something simple.
How does this plugin help?
When you look at where the attempts are coming from they are all around the world. There is no relationship, other than they all occur in sequence while an attack is going on.
What this plugin does (allegedly) is verifies the source country the attempt is coming from, and checks it against a list of “whitelisted” (approved) countries. When you look at your sites usage, and target audience, there is probably no valid reason why someone from Ukraine or Yemen should be accessing it. Your audience (for 99% of my client base) is wholly UK based, and regionally quite small.
How do you know if it is working
When I look at Google Analytics it tells me which countries are accessing a website. If this plugin does what it claims it can do, I should see only UK based IP addresses accessing the site say one month later.
I will report back on it at the end of January. For now I have installed it on a couple of sites to see whether it makes a difference.
Can I try to use it?
You can add this to your website if you wish. Login and go to the Plugins page and Add New Plugin. Look for IP Geo Block by Tokkonopapa.
After you have installed it, activate it and look at the settings from the dashboard and locate the IP Geo Block settings at the bottom of the list.
When you get to the first screen add “,US” after GB in the Whitelist Country Code. Your screen should look like this: GB,US
Why do you need US? Because a legitimate crawler such as Bing or Google may index and scan your site from the USA. You do want this to happen.
Scroll down to the bottom of the page and click on Import Pre-defined settings and choose Best Settings. This will load a standard set of parameters. Then save changes and exit.
Testing it
Check you can still access your website and that it behaves normally. If it does not for any reason go back into the Plugins menu item and deactivate the plugin and then remove it.
Do remember if you are going overseas for any reason, then you may not be able to access the site, because you have added this in.
Feedback?
If you try this let me know how you get on with it. I will report back in 3 weeks on my findings.