> ## Content Index
> Fetch the complete content index at: https://www.boldoutlook.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Create a List of IP Addresses Attacking Your WordPress Login
- URL: https://www.boldoutlook.com/create-list-ip-addresses-attacking-wordpress-login/
- Published: 2016-06-27T04:00:00.000Z
- Updated: 2025-07-25T04:32:17.000Z
- Description: These are the steps I use to create a list of IP addresses that are trying to login to my WordPress installations that did not have permission to do so. The following steps assumes that only you (or certain IP addresses) have access to your WordPress login, wp-login.php.
- Author: Brandon Himpfen
- Tags: Digital, Learning Centre, WordPress, Security, Technology, #Import 2026-10-18 13:20

These are the steps I use to create a list of IP addresses that are trying to login to my WordPress installations that did not have permission to do so. The following steps assumes that only you (or certain IP addresses) have access to your WordPress login, wp-login.php. 

Checkout [Cloudways](https://tinyurl.com/2p95vujw) for affordable managed WordPress hosting or [Digital Ocean](https://tinyurl.com/d6h9936b) for self-managed WordPress hosting. 

You will also need the ability to run Linux commands.

## The Steps

You’ll start by grabbing all occurrences of wp-login.php in your error*log. This is because you have denied access to your wp-login.php, except for you, so if someone tries to go there, your server will show a error and record it in your error*log.

```
grep -iR wp-login.php sites.himpfen.com-error_log >> data.txt

```

Change sites.himpfen.com-error*log to your error*log. The results will be written to data.txt.

Next, you’ll create a new file that only shows the IP addresses.

```
grep -E -o '(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)' data.txt >> ipsonly.txt

```

So here, we took the only IP addresses from data.txt, which we created in step one and written the IP addresses to ipsonly.txt.

Finally, we need to remove duplicate IP addresses. You can do this with two different commands.

```
awk '!x[$0]++' ipsonly.txt > IPAddresses.txt

```

OR

```
sort -u ipsonly.txt > IPAddresses.txt

```

You’re done!

The final list will be in IPAddresses.txt. I should also mention that you should check IPAddresses.txt for your own IP address. Why? Your IP address can change without notification to you, so you might have went to login and been disallowed by the server.