Brute Force attack error in magereport tester

Question

We are having issue with the 'BRUTEFORCE ATTACK ?' option in magereport.

We are trying to install the 8788 patch on website. Was successfully able to install the 8788 patches on the website but not able to fix the 'BRUTEFORCE' option mentioned in magereport. The .htaccess rules are working on normal linux servers and also plesk servers but we are having issues with the same rule on Cpanel server's.

We have tried all the possible combinations to fix the error but this is still showing. Do any one have an idea on this? Why is the error still showing where as the same rule works on plesk/No interface server while it is not working on a Cpanel server? Please let us know.

Below rule is used.

Please note - both downloader and admin url is renamed.

RewriteCond %{REMOTE_ADDR} !^xx.xx.xx.xx
RewriteRule ^(index.php/?)?rss/ - [L,R=403]
RewriteCond %{REMOTE_ADDR} !^xx.xx.xx.xx
RewriteRule ^(index.php?)?rss/ - [L,R=403]

Answer 1

What does Magereport check for?

Magereport checks these URL’s:

/index.phprss/catalog/notifystock/ (yes, without the slash) /admin /downloader An error is raised, when an admin/downloader login screen is found, or a basic auth dialogue (on rss).

see the below links for more information: https://support.hypernode.com/knowledgebase/how-to-protect-your-magento-store-against-brute-force/

https://magento.com/security/best-practices/protect-your-magento-installation-password-guessing-new-update

Answer 2

In the place you put above code, please add below one and try again.

RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} ^.*/RSS/CATALOG [OR,NC] 
RewriteCond %{REQUEST_URI} ^.*/RSS/ORDER [OR,NC]
RewriteCond %{REQUEST_URI} ^.*RSS/CATALOG [NC]  
RewriteRule ^(.*)$ http://%{HTTP_HOST}/ [R=302,L] 

RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} ^.*/RSS/CATALOG [OR,NC] 
RewriteCond %{REQUEST_URI} ^.*/RSS/ORDER [OR,NC]
RewriteCond %{REQUEST_URI} ^.*RSS/CATALOG [NC]  
RewriteRule ^(.*)$ https://%{HTTP_HOST}/ [R=302,L] 

Answer 3

Protect your Magento Store to Brute force attacks. Follow following step.

Apache Server Users

To whitelist an IP address for the admin panel, add the following rule in root .htaccess file (inside <IfModule mod_rewrite.c>)

RewriteCond %{REMOTE_ADDR} !^xx.xx.xx.xx
RewriteRule ^(index.php/)?admin/ - [L,R=403]

To whitelist an IP address for the RSS feed, add the following rule in the root .htaccess file (inside <IfModule mod_rewrite.c>):

RewriteCond %{REMOTE_ADDR} !^xx.xx.xx.xx
RewriteRule ^(index.php/?)?rss/ - [L,R=403]

To whitelist an IP address for the downloader application, add the following rule in ./downloader/.htaccess file:

order deny,allow
deny from all
allow from xx.xx.xx.xx

Hope It's helpful for any one..Thank You

Answer 4

I was getting same issue and i have fixed it by using these rule in root .htaccess file.

Note: it should be written before enable rewrites code RewriteEngine on

<IfModule mod_rewrite.c>


RewriteRule ^/?(index.phprss|index.php/rss/catalog|index.php/rss/catalog/notifystock|rss/catalog/notifystock|index.php/rss/order|rss/catalog|rss/order).*$ / [R=301,L,NC]

RewriteCond %{REMOTE_ADDR} !^xxx.xxx.xxx.xxx
RewriteRule ^(index.php/)?admin/ - [L,R=403]

RewriteCond %{REMOTE_ADDR} !^xxx.xxx.xxx.xxx
RewriteRule ^(index.php/)?downloader/ - [L,R=403]


</IfModule>