WP Login Protection with CSF -LFD

Leo Santis

• January 06, 2026 14:11

CSF LFD works great as it is for SSH, CPanel, FTP as it is and I though why not configure it same way for WordPress logins.

Came up with this idea after checking access.log and see how absurd attackers try to force it as well as XMLRPC

 

I’m using Nginx, and after a lot of reading I’ve tried:

Edit /etc/csf/csf.conf and change CUSTOM1_log to 

CUSTOM1_LOG = "/var/log/nginx/access.log"

Added customs rules in /usr/local/csf/bin/regex.custom.pm

# WPLOGIN Attacks
if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] "\w*(?: GET|POST) \/wp-login.php.*" /)) {

    return ("WP Login Attack",$1,"WPLOGIN","3","80,443","1");

}

# XMLRPC Attacks

if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] "\w*(?: GET|POST) \/xmlrpc.php.*" /)) {

    return ("WP XMLRPC Attack",$1,"XMLRPC","3","80,443","1");

Basically, after a 3^rd login failure IP should be blocked.

After implement this and restarted CSF, I’ve tried false logins and even a true login with wrong passwords(using a VPN) and nothing happens.

What am I missing here?

• 

  ffeingol

  • January 06, 2026 17:54

  The requests are more than likely logged to the sites access log, not the main access log (i.e. under domlogs/*/*).  We don't use Nginx, so I can't tell you the exact path.

  0
• 

  Leo Santis

  • January 06, 2026 19:25

  That’s my point.
  When you have only Apache this could run using a CSF custom log like CUSTOM1_LOG = "/var/log/apache2/domlogs/*/*"

  When using Nginx, CUSTOM1_LOG = "/var/log/nginx/access.log"

  As Cpanel Nginx add-on  is not really a standalone Nginx version that may be the case of using something different than both.

  0
• 

  Leo Santis

  • January 07, 2026 12:36

  Just to give a feedback here as others may search the same in the future.

  I’ve just give it a try using CUSTOM1_LOG = "/var/log/apache2/domlogs/*/*" and let it run overnight and I’ve got a couple of attackers dully trapped.

  So, basically, it doesn’t matter if you use Nginx or not, recipe is the same for both.

  0
• 

  Mise

  • January 08, 2026 20:51

  also you can try with the same word appearing  in the previous phrase: 

  return ("WPLogin Attack",$1,"WPLogin","3","80,443","1");

  ...just to discard it because sometimes it can happen. I don't know why.

   

  0

Please sign in to leave a comment.