Protect Joomla Install by Redirecting WordPress Attack Bots 🛠 Maintenance Monday Live Stream #014

Written by: Tim Davis Created: 20 November 2017

Category: Maintenance Monday

Hot!Hits: 761Reading time: 02:00

Even though you are using Joomla , attack bots looking for WordPress vulnerabilities are still trying to hack your web hosting account. These can be simply removed from the equation by redirecting them to a dummy page. That's what this Maintenance Monday takes a look at.

00:00 - Handling WordPress Bot Attacks on Joomla Sites with 404 Redirects
12:45 - Managing Bot Attacks on Joomla: Redirects and Tracking Techniques
17:39 - Q&A on Joomla Redirect Strategies: Combining Multiple Rules

Summary

Introduction to the Issue: WordPress attack bots can affect Joomla sites by generating 404 errors, which use up server resources and distort site analytics.
Why It Matters: These bots target WordPress-specific URLs like wp-login.php, but Joomla sites with broken URL tracking tools and Google Analytics could still register these bot requests.
Problem of 404 Errors: Each bot request triggers a 404 error, which is logged and can clutter your database, slow down the site, and skew analytics.
Solution Overview: The solution involves redirecting bot requests for WordPress-specific URLs to a blank HTML file, bypassing Joomla's processing of these requests.
Creating a Blank HTML Page: In the Joomla root directory, create a simple HTML file (e.g., no-thanks.html) to serve as the redirect destination. This file doesn’t need to contain content as bots will not see it.
Editing .htaccess File: Modify the .htaccess file to add a rewrite rule. This rule catches requests for WordPress URLs (e.g., wp-login.php) and redirects them to the blank HTML file.
Rewrite Rule Details: The rewrite rule redirects any URL containing wp-login or similar WordPress URLs (like wp-admin) to the no-thanks.html page, using a 301 permanent redirect.
Testing the Redirect: After saving the .htaccess file, test the redirect by visiting the targeted WordPress URLs. The bot requests should immediately redirect to the blank page, preventing the creation of 404 errors.
Additional Redirect Rules: To block more WordPress bot attacks, create additional redirect rules for other WordPress-related URLs (e.g., wp-admin, wp-includes).
Other Options: For users not using sh404sef, the Joomla core redirect component can also be used to set up these redirects without the need for .htaccess file edits.