http authentication for WP Login

check the nginx access and error logs for wp-login.php requests with 401 statuses as well as entries like

Code:

no user/password was provided for basic authentication.
user .* was not found in.
user .* password mismatch.

where .* would of been USERNAME matches

 

use grep or egrep on choice keywords to the access.log or error.log

 

for status code grep/awk see centminmod.com/nginx.html#accesslog

and these

Code:

grep user /usr/local/nginx/logs/access.log
grep 'basic authentication' /usr/local/nginx/logs/access.log
grep password /usr/local/nginx/logs/access.log
grep 'wp-login.php' /usr/local/nginx/logs/access.log
grep 'mismatch' /usr/local/nginx/logs/access.log

you should read up on using grep, egrep and awk commands

any person working with servers in SSH should learn these

There's still plenty of ways for data to be intercepted beyond the email stage, i.e. insecure home or work wifi or public wifi on either or both your end or the clients.

All my home (thus work) mobile and tablet wifi is over encrypted secure private OpenVPN or L2TP IPSEC based VPN servers and my main work PC has no wifi and only wired connection.

Also possibility of WP plugin or malware infection at server or database level, of which http basic authentication won't have any usefulness in preventing intruder access.