date('c'), 'ip' => $ip, 'attempt' => $attempts, 'username' => $submitted_user, 'password' => $submitted_pass, 'remember_me' => $remember_me, 'redirect_to' => $redirect_to, 'method' => $_SERVER['REQUEST_METHOD'], 'uri' => $_SERVER['REQUEST_URI'], 'headers' => $headers, 'first_seen' => $first_seen, 'delay_applied'=> min($attempts * 2, $max_delay), 'country' => $headers['cf_ipcountry'] ?? null, 'cf_ray' => $headers['cf_ray'] ?? null, ]; file_put_contents($intel_file, json_encode($intel) . "\n", FILE_APPEND | LOCK_EX); // Save state $state = [ 'attempts' => $attempts, 'first_seen' => $first_seen, 'last_seen' => date('c'), 'last_user' => substr($submitted_user, 0, 64), 'creds_tried' => array_slice($creds_tried, -100), // keep last 100 ]; file_put_contents($state_file, json_encode($state, JSON_PRETTY_PRINT)); // Progressive tarpit: 2, 4, 6... up to max_delay $delay = min($attempts * 2, $max_delay); sleep($delay); // Rotate through realistic error messages $errors = [ 'Error: The password you entered for the username %s is incorrect. Lost your password?', 'Error: The password you entered for the username %s is incorrect. Lost your password?', 'Error: Unknown username. Check again or try your email address.', 'Error: The password you entered for the username %s is incorrect. Lost your password?', 'Error: There has been a critical error on this website. Learn more about troubleshooting WordPress.', ]; // After many attempts, mix in session expired and rate limit messages if ($attempts > 12 && $attempts % 4 === 0) { $show_expired = true; } if ($attempts > 15 && $attempts % 5 === 0) { $error_msg = 'Error: Too many failed login attempts. Please try again in 15 minutes.'; } else { $error_idx = ($attempts - 1) % count($errors); $error_msg = sprintf($errors[$error_idx], htmlspecialchars($submitted_user)); } } else { // GET request — also log reconnaissance $headers = get_interesting_headers(); $intel = [ 'timestamp' => date('c'), 'ip' => $ip, 'attempt' => 0, 'type' => 'recon', 'method' => 'GET', 'uri' => $_SERVER['REQUEST_URI'], 'query' => $_SERVER['QUERY_STRING'] ?? '', 'headers' => $headers, 'first_seen' => $first_seen, 'country' => $headers['cf_ipcountry'] ?? null, ]; file_put_contents($intel_file, json_encode($intel) . "\n", FILE_APPEND | LOCK_EX); // Returning visitors get a delay even on GET if ($attempts > 0) { sleep(min($attempts, 5)); } } // --- Derive values for the page --- $php_version = phpversion(); $wp_json_url = rtrim($site_url, '/') . '/wp-json/'; // --- Render fake login page --- http_response_code(200); header('X-Frame-Options: SAMEORIGIN'); header('Content-Type: text/html; charset=UTF-8'); header('X-Powered-By: PHP/' . $php_version); if ($site_url) { header('Link: <' . $wp_json_url . '>; rel="https://api.w.org/"'); } ?> Log In ‹ <?php echo htmlspecialchars($site_name); ?> — WordPress

Powered by WordPress

Session expired. Please log in again.

← Go to