I’m sure that some wordpress website owners must have become familiar with the alert
Attack protection CAPTCHA. Enter Username: //e.g. bd98ai Password: The result of math 19+12
when they try to access their wp-login.php page. A simple fact is: not all webmasters or bloggers tend to use the same web host; and due to this fact, the encounter with the Attack protection captcha alert varies. The alert is not an error or a mistake, it’s just to let you know that you have an extra protection system running on your blog via the web host you’re using. The main purpose of the extra protection is to protect your blog/website against attackers that uses botnet to brute force (guess password) for admin user account and thereby getting to gain the access to the wp-admin.php page of your blog/website illegally. Before I proceed, let’s take a quick look at what Brute force and what Botnet are, and how they can be of great disadvantages.
According to the computer dictionary definition, Brute force is a password and cryptography attack that does not attempt to decrypt any information, but rather continue trying different combinations i.e. passwords, words or letters until it gains access to the target’s account. What this means is: the attack does not attempt to know the original information (password for example), but rather the attack attempts to combine different letters, figures or characters, till it gains access to the target’s account.
Brute force does not search for vulnerability, but rather for possibilities.
A botnet is a large number of compromised/hijacked computers that are used to generate spam, release viruses or flood a network or web server with excessive requests to cause it to fail. They are currently one of the worst threats on the internet; they attempt to perform malicious tasks on computers without the owners’ permission or awareness. One of these tasks could be: spreading of viruses, leaving spam comments or sending spam messages etc.
You can decide to keep using the additional protection as it is, or rather remove it permanently. For more clarification, let’s take a look at an example below:
To gain access to your wp-login.php page in this example, you’ll need to input the username bc19ip in the username input field. And as you can see, it says Password: the result of math 18+5 which is 23 .
The username would be: bc19ip
And password: 23
After inputting these correctly, you’ll have access to your wp-login.php page, fill in the fields appropriately on the page, and then you’ll have access to your admin page.
To prevent this captcha alert from popping up the next time you’ll be accessing the wp-login.php page, you can either contact the support team of the host you use; or rather add the following to your .htaccess file in your /public_html folder
<filesmatch "wp-login.php"> Satisfy Any </filesmatch>
The line above will disable the extra protection system for your website or blog(even if not powered by wordpress) and the alert box won’t pop up anymore.
The extra protection is adviceable, though it might get annoying when you need to login to your admin page urgently, especially on your mobile and the alert box pops up. Whichever way, be well informed that it’s not an error, and try as much as possible to use a strong password, so as to make it complicated for a bot to brute force after disabling the system.