Getting repeatedly locked out of WP site

This is a naive question, because I haven’t manually configured a WP installation for many years. I am a partner in an online newsmagazine built on WordPress. Our site has been up for years with no problems. However, just in the last month or so, we are having issues with “Denied for Too Many Attempts” messages when trying to log in to post new content. There are two primary author/admins and neither of us can log in any more.

The site is hosted by GoDaddy. We can still get into it by logging in through GoDaddy using the senior admin’s credentials, and our site does not eppear to be compromised (whew). But logging in via wp-admin is now permanently broken.

We are using a plugin to limit login attempts. I have tried to whitelist my individual username and IP address to regain access, but so far no success. I am afraid to turn it off (see below) although it’s tempting to disable and re-enable it in hope of resetting something.

I was able to get at the stats/logs maintained by the plugin. I found them frankly rather unbelievable. According to its “failed login limit log” we have been experiencing over 1 million attempted logins per day, mostly from the US but quite a lot from Russia, China, etc.

We are a tiny, obscure little home-town online newspaper for a remote rural community in the back of beyond, BC. Why anyone would be DOSing us is beyond me, especially with such international scope.

So my questions are many, at this point 🙂 but the primary ones are:

Do these ridiculously large numbers mean that our login attempt limit plugin is broken, its database compromised, etc? Or is this kind of 24×7 DOSing or attempted hacking just normal these days?

Is there any way to recover normal login access given what looks like a nonstop storm of attacks on our wp-admin login page?

Is there any way, via GoDaddy, for me to get access to the backend tables to try to reset the “failed login count” for my username? Or given the level of attack going on, is this just hopeless because in the seconds it takes me to reset this counter and try my login again, there will be another N attacks and I’ll be locked out again?

I should perhaps note that I “fixed” this problem a couple of weeks ago by upgrading PHP to the latest version. We were normal for a few days after that. I have no idea why. Could be coincidence.

I’m hopelessly out of date on WP — last time I manually crafted an installation was in the early 2000’s. I also came in late to this one and don’t know its full history. But I’m the most technically qualified person working on the project so I’m trying to figure this out. Advice will be very gratefully received!

• This topic was modified 2 years, 5 months ago by Jan Dembowski. Reason: Moved to Fixing WordPress, this is not an Everything else WordPress topic