Further development of an existing log filter rule

Webmin
1
SYSTEM INFORMATION
OS type and version Debian 12
Webmin version 2.202

Ilia has given us this rule

<xmp>

<HOST>.*POST.*(wp-login\.php|xmlrpc\.php|account\/signin).* 200

</xmp>

for banning unwanted wordpress logins and it works for 1000s of IP’s. 

But it doesn’t grasp this log line:

103.77.162.13 - - [06/Oct/2024:15:13:02 +0200] "POST /xmlrpc.php HTTP/1.1" 503 22644 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36"

Can any script wizzard help me in perfectioning my wordpress jail?

Thank you very much!
2

Most likely, the following will work:

<HOST>.*POST.*(wp-login\.php|xmlrpc\.php|account\/signin).* (200|503)
1 Like
3

Yes, it works.

Thank you Ilia …

4

You’re welcome!

5

This topic was automatically closed 8 days after the last reply. New replies are no longer allowed.