ブルーフォースアタック攻撃？毎日のように受けていてお腹いっぱいですが何か？

タイトル通り、ブルートフォースアタックは毎日受けています。
英語では「Brute force attack」
日本語では「総当たり攻撃」または「力任せ攻撃」

もう勘弁してほしいです。

エックスサーバーのアクセスログを確認しています

中国からのアタックは、ユーザー名を author 1～20 まで探るのが特徴。

“GET /wp-login.php HTTP/1.1”
“GET /?author=1 HTTP/1.1”
“GET /author/********* HTTP/1.1”
“GET / HTTP/1.1”
“GET /?author=2 HTTP/1.1”
“GET /?author=3 HTTP/1.1”
“GET /?author=4 HTTP/1.1”
“GET /?author=5 HTTP/1.1”
“GET /?author=6 HTTP/1.1”
“GET /?author=7 HTTP/1.1”
“GET /?author=8 HTTP/1.1”
“GET /?author=9 HTTP/1.1”
“GET /?author=10 HTTP/1.1”
“GET /?author=11 HTTP/1.1”
“GET /?author=12 HTTP/1.1”
“GET /?author=13 HTTP/1.1”
“GET /?author=14 HTTP/1.1”
“GET /?author=15 HTTP/1.1”
“GET /?author=16 HTTP/1.1”
“GET /?author=17 HTTP/1.1”
“GET /?author=18 HTTP/1.1”
“GET /?author=19 HTTP/1.1”
“GET /?author=20 HTTP/1.1”

中国以外の基本形。ユーザー名を GET しようとしたり、xmlrpc.php を POST しようとしたり大忙し。

“GET / HTTP/1.1” 
“GET / HTTP/1.1”
“GET //wp-includes/wlwmanifest.xml HTTP/1.1”
“GET //?author=1 HTTP/1.1”
“GET //?author=2 HTTP/1.1”
“GET //wp-json/wp/v2/users/ HTTP/1.1”
“GET //wp-json/oembed/1.0/embed?url=https://zbnr-hp.com/ HTTP/1.1”
“POST //xmlrpc.php HTTP/1.1”

過疎化しているサブドメインは WordPress ではなく HTML で作っているのでアタックされてもね。
「/wp-includes/wlwmanifest.xml」を18回も検索されても無いです！

calendar.zbnr-hp.com “GET / HTTP/1.1”
zbnr-hp.com “GET / HTTP/1.1”
calendar.zbnr-hp.com “GET / HTTP/1.1”
calendar.zbnr-hp.com “GET //wp-includes/wlwmanifest.xml HTTP/1.1”
calendar.zbnr-hp.com “GET //xmlrpc.php?rsd HTTP/1.1”
calendar.zbnr-hp.com “GET / HTTP/1.1”
calendar.zbnr-hp.com “GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1”
calendar.zbnr-hp.com “GET //web/wp-includes/wlwmanifest.xml HTTP/1.1”
calendar.zbnr-hp.com “GET //wordpress/wp-includes/wlwmanifest.xml HTTP/1.1”
calendar.zbnr-hp.com “GET //website/wp-includes/wlwmanifest.xml HTTP/1.1”
calendar.zbnr-hp.com “GET //wp/wp-includes/wlwmanifest.xml HTTP/1.1”
calendar.zbnr-hp.com “GET //news/wp-includes/wlwmanifest.xml HTTP/1.1”
calendar.zbnr-hp.com “GET //2020/wp-includes/wlwmanifest.xml HTTP/1.1”
calendar.zbnr-hp.com “GET //2019/wp-includes/wlwmanifest.xml HTTP/1.1”
calendar.zbnr-hp.com “GET //shop/wp-includes/wlwmanifest.xml HTTP/1.1”
www.zbnr-hp.com “GET / HTTP/1.1”
calendar.zbnr-hp.com “GET //wp1/wp-includes/wlwmanifest.xml HTTP/1.1”
calendar.zbnr-hp.com “GET //test/wp-includes/wlwmanifest.xml HTTP/1.1”
calendar.zbnr-hp.com “GET //wp2/wp-includes/wlwmanifest.xml HTTP/1.1”
calendar.zbnr-hp.com “GET //site/wp-includes/wlwmanifest.xml HTTP/1.1”
calendar.zbnr-hp.com “GET //cms/wp-includes/wlwmanifest.xml HTTP/1.1”
calendar.zbnr-hp.com “GET //sito/wp-includes/wlwmanifest.xml HTTP/1.1”
calendar.zbnr-hp.com “” 400 0 “-” “-“
www.zbnr-hp.com “GET //wp-includes/wlwmanifest.xml HTTP/1.1”
www.zbnr-hp.com “GET //?author=1 HTTP/1.1”
www.zbnr-hp.com “GET //?author=2 HTTP/1.1”
www.zbnr-hp.com “GET //?author=3 HTTP/1.1”
www.zbnr-hp.com “GET //wp-json/wp/v2/users/ HTTP/1.1”
www.zbnr-hp.com “GET //wp-json/oembed/1.0/embed?url=https://zbnr-hp.com/ HTTP/1.1”
www.zbnr-hp.com “POST //xmlrpc.php HTTP/1.1”

対策

IPアドレスで拒否

サーバーのIPブロック機能を活用するか .htaccess にこのように記述してアクセス拒否すると良いですが、
IP はいくらでも変えられるので意味は薄いかも。

deny from 139.155.242.183
deny from 104.43.246.183

対策

ログインユーザー名を隠す

各ファイルを.htaccessで拒否設定

二段階認証

サーバーのセキュリティ設定

パーミッションを変更する

IPアドレスで拒否