Update brute-force.md documentation#424
Open
garrettb-imh wants to merge 1 commit intoWordPress:mainfrom
Open
Conversation
kittenkamala
added
the
WCUS-CD-2025
|
Great work! Thank you so much. |
2 tasks
|
Thank you for contributing @garrettb-imh |
GiggleSquid
reviewed
Aug 28, 2025
| **Limit access to `/wp-login.php` by IP:** | ||
| ```caddyfile | ||
| @blacklist { | ||
| not remote_ip forwarded 203.0.113.15 203.0.113.16 |
There was a problem hiding this comment.
I believe remote_ip forwarded is deprecated since caddy v2.8.0 in favour of client_ip with the use of the trusted_proxies directive
See:
Deprecation: https://github.com/caddyserver/caddy/releases/tag/v2.8.0
client_ip: https://caddyserver.com/docs/caddyfile/matchers#client-ip
trusted-proxies: https://caddyserver.com/docs/caddyfile/options#trusted-proxies
There was a problem hiding this comment.
Clarification
It is long deprecated and was removed in 2.8.0
Crixu
requested changes
Sep 8, 2025
Member
Crixu
left a comment
Crixu
left a comment
There was a problem hiding this comment.
Content looks great, my recommendation would be to replace the current file instead of adding a new one.
mindctrl
added a commit
to mindctrl/Advanced-administration-handbook
that referenced
this pull request
Feb 6, 2026
Content is from WordPress#424 and was updated to address remaining feedback. Closes WordPress#151.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This article mixes good guidance with a lot of legacy/fragile techniques and repeats some sections. I’ve prepared a full modernization that emphasizes 2FA/passkeys, edge/WAF rate-limiting, XML-RPC protections, and keeps concise Apache/Nginx/IIS plus new Caddy v2 examples. It also adds a See Also link to the Caddy thread discussed with core maintainers.
Highlights
• Keep: strong passwords, avoid admin, server-side examples (updated).
• Add: 2FA + passkeys (plugin/IdP), edge/WAF login throttling, CAPTCHA/Turnstile, XML-RPC controls, clearer Nginx/Apache/IIS, and Caddy v2 snippets.
• Remove/soften: country IP blocklists (collateral damage), BasicAuth over all of /wp-admin (breaks AJAX), repeated sections.
Based on comment suggestion, Caddy reference added: Using Caddy to deter brute force attacks in WordPress – https://caddy.community/t/using-caddy-to-deter-brute-force-attacks-in-wordpress/13579