Locked out and image problems

Since our website (http://www.planestrainsautomobiles.co.uk) has gone live we are receiving several spam attempts to register new users and our wordpress account has been locked twice. We receive the below message. To unlock it we have to go to the hosting account.

For your security, your account has been locked because of too many failed login attempts. To unlock your account please click the following link:

Could this be a theme issue?

Also our image do no display on the mobile theme for example an IPAD and when using the Iphone no posts at all are displayed.

a) make sure you clear all your caching after changing themes; make sure your CDN/cloudflare etc supports mobile devices

b) make sure you regenerate thumbnails to ensure mobile sized images actually exist

c) use a plugin like ‘limit login attempt’s to stop people from trying to guess your password for WordPress; make sure you deleted your “admin” account and made the superuser some other name (e.g., anything other than ‘admin’ and not your site name like ‘planesadmin’ would be dumb!)

d) make sure you use Akismet for basic spam protection

e) consider other security “hardening” features (do google search for “WordPress Security Hardening”)

f) why would your WordPress self-hosted platform lock yourself out of your own admin account? Bizarre that your hosting provider turns off access to your WP admin — that isn’t nice.

Thanks.

The images were all ok a couple of days ago and the posts but now they don’t display. I’ve spoken to the Go Daddy team who suggested using Site Lock. They seem to think the theme or a plugin may be causing the issue with being locked out.

Hi,

I don’t see a logo in your site and I’m using desktop. The theme seems to be printing the image URL “http://www.planestrainsautomobiles.co.uk/wp-content/uploads/2015/06/PTA-logo-web-2.png” but server says that image is not there. Try to reset the image/logo at the theme panel.

About security, it’s a big topic.
Wordpress sites get targeted a lot, I would be very surprised if it was theme related. There’s many things you can do to help fight those bots and scripts, just a few I recall:

– admin user account should not be “admin”. bots try that account 1st thing and if they see the account is active, they’ll brute force try to guess the password. admin account should not be the name of the website, they try that 2nd.

– require captcha to login (but this hurts real users experience IMO)

– use a plugin to limit login attempts

I use a combination of wordfence plugin + cloudflare CDN.
Wordfence is neat, I don’t use premium edition, free one does a lot already, including some of the work a limit login attempts plugin would do. Supposedly, websites with wordfence communicate with wordfence services and if they spot an IP sweeping websites trying to login, they spread the word and it gets blocked. cloudflare helps cause they divert IPs with bad reputation and you can set it to high security (good in case of a big attack), which checks browser integrity, javascript execution and sometimes ask human interaction almost like captcha. They allow page rules so I keep the whole site with standard security but the wp-login page gets max.

Even with all of this, I still get targeted anyways. I know cause I have a rule to block IP for 30min if it tries to log in with “admin” and it triggers from time to time. Sometimes it comes in waves, specially after a big WP update cause bots go crazy over exploits discovered and they start scanning sites that didn’t update already. Just my 2 cents/experience, hope it helps, cheers!

Thanks. We have also used a mega menu for our links to categories. On two occasions now the images have stopped working. So our menu now doesn’t display the images that link to the categories.