# Bruteforce Wordpress

**URL:** <https://discourse.haproxy.org/t/bruteforce-wordpress/2706>\
**Category:** Help!\
**Created:** [July 9, 2018, 1:03pm UTC](https://discourse.haproxy.org/t/bruteforce-wordpress/2706 "2018-07-09T13:03:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![c0r3dump3d](https://avatars.discourse-cdn.com/v4/letter/c/a587f6/32.png) [@c0r3dump3d](https://discourse.haproxy.org/u/c0r3dump3d)\
**Post date:** [July 9, 2018, 1:03pm UTC](https://discourse.haproxy.org/t/bruteforce-wordpress/2706/1 "2018-07-09T13:03:20Z")

</div>

Hi, I’m trying to implement a Wordpress bruteforce protection at haproxy level, version **1.5.18 in CentOS 7**. I’m folowing the manual [https://www.haproxy.com/blog/wordpress-cms-brute-force-protection-with-haproxy/](https://www.haproxy.com/blog/wordpress-cms-brute-force-protection-with-haproxy/) but I’m not able to make it work.  
In the frontend section I have:

```
    tcp-request inspect-delay 10s
    tcp-request content accept if HTTP

    acl wp_login path_beg -i /wp-login.php
    acl flagged_as_abuser sc1_get_gpc0 gt 0
    stick-table type binary len 20 size 500 store gpc0
    tcp-request content track-sc1 base32+src if METH_POST wp_login
    http-request deny if flagged_as_abuser

```

In the backend section I have:

```
    tcp-request inspect-delay 10s
    tcp-request content accept if HTTP
    acl wp_login path_beg -i /wp-login.php
    stick-table type binary len 20 size 500 store gpc0,http_req_rate(5s)
    tcp-request content track-sc2 base32+src if METH_POST wp_login
    stick store-request base32+src if METH_POST wp_login
    acl bruteforce_detection sc2_http_req_rate gt 5
    acl flag_bruteforce sc1_inc_gpc0 gt 0
    http-request deny if bruteforce_detection flag_bruteforce

```

Whe I show the table in the backend I see that the http\_req\_rate always has zero value:

```
   # table: webphp56_servers, type: binary, size:500, used:6
   0x5578f86675e4: key=3AAE35AFC1C9E0C1000000000000000000000000 use=0 exp=0 server_id=10 gpc0=0 http_req_rate(5000)=0
   0x5578f8907874: key=4C6CF94FBB10374B000000000000000000000000 use=0 exp=0 server_id=10 gpc0=0 http_req_rate(5000)=0
  0x5578f8a994f4: key=CE6B86EB8ACC472F000000000000000000000000 use=0 exp=0 server_id=7 gpc0=0 http_req_rate(5000)=0

```

What am I doing wrong?

Thank you in advance.

---

<div class="post-metadata">

**Author:** ![c0r3dump3d](https://avatars.discourse-cdn.com/v4/letter/c/a587f6/32.png) [@c0r3dump3d](https://discourse.haproxy.org/u/c0r3dump3d)\
**Post date:** [July 10, 2018, 11:26am UTC](https://discourse.haproxy.org/t/bruteforce-wordpress/2706/2 "2018-07-10T11:26:02Z")

</div>

Hi, I have found one possible solution using other proposals again from haproxy blog ([https://www.haproxy.com/blog/use-a-load-balancer-as-a-first-row-of-defense-against-ddos/](https://www.haproxy.com/blog/use-a-load-balancer-as-a-first-row-of-defense-against-ddos/)) and from ([https://gist.github.com/jeremyj/e964a951634f1997daea](https://gist.github.com/jeremyj/e964a951634f1997daea)) with some minor modifications:

In the frontend section you must to put:

```
acl wp_login path_end -i /wp-login.php
stick-table type ip size 1m expire 60s store gpc0,http_req_rate(10s)
tcp-request content track-sc1 src if METH_POST wp_login
tcp-request content reject if { src_get_gpc0 gt 0 }
http-request deny if { src_get_gpc0 gt 0 }

```

In the backend section the confguration is:

```
acl abuse src_http_req_rate(web_http) ge 5
acl flag_abuser src_inc_gpc0(web_http) ge 0
http-request deny if abuse flag_abuser

```

In this case I consider an abuser 5 login attemps in 10 seconds.

if it can be useful to someone else an I have put this solution in a github:

> **[c0r3dump3d/haproxy-wp-bruteforce-proteccion](https://github.com/c0r3dump3d/haproxy-wp-bruteforce-proteccion)**
>
> haproxy configuration in order to protect bruteforces attack with haproxy - c0r3dump3d/haproxy-wp-bruteforce-proteccion