Awk Scan for wp-login

Luke Hebert

- 2 minutes read - 223 words

If you manage a WordPress site and want to know which IPs are hammering your login page, a single awk pipeline over your access log does the job in seconds. The command below counts wp-login.php hits per IP and prints only those that exceed a threshold of five requests.

The Command

tail -500 theultimateguidetowpnet.internet-marketing-muscle.com \
  | awk '$7 ~ /\/wp-login.php/ {print}' \
  | awk '{print $1}' \
  | uniq -c \
  | while read ct ip; do
      if [[ $ct -gt 5 ]]; then
        echo "$ip"
      fi
    done

How It Works

  1. tail -500 grabs the last 500 lines of the named access log file.
  2. First awk filters for lines where the request URI (field 7) contains /wp-login.php.
  3. Second awk extracts the client IP (field 1).
  4. uniq -c counts consecutive identical IPs.
  5. The while loop prints only IPs whose count is greater than 5.

Tips

  • Swap tail -500 for cat or a date-range filter if you need a wider window.
  • Adjust the -gt 5 threshold to match your normal traffic baseline.
  • Pipe the output into whois or a threat-intel lookup to identify the source.
  • If your log format differs (e.g., combined vs. common), verify that field 7 is still the URI before running the filter.

This is a fast, dependency-free way to surface suspicious login-page activity without pulling in a full log-analysis tool.