阻止Wordpress / wp-admin但仍受到攻击

Question

Thinking I was being a good developer I blocked access to Wordpress admin using this .htaccess code:

RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^XX.XX.XX.XX$     #My IP Address
RewriteRule ^(.*)$ - [R=403,L]

I have Sucuri on the website and it is informing me that someone is trying to hack in by using versions of Author usernames, problem is their IP address changes constantly so I cannot add a Deny.

I cannot get to the admin with this above htaccess code (if I remove my IP address!) ... how are they!?

Thanks, J

Answer 1

try adding/editing .htaccess in wp-admin folder directly:

Order Deny,Allow
Deny from all
Allow from xxx.xxx.xxx.xxx #your IP