Why don't you use
.htaccess? It should protect you against brute force attacks, and it's easely configurable.
We do use something like this, an
.htaccess file located into the root of the website, containing the following:
## Hardening wp - doublelogin
AuthName "Double Login antibot"
.htpasswd file, located anywhere you want on your local drive. You just need to specify the full path to the
.htpasswd file with the
AuthUserFile directive. Choose whatever you deem to be a sane location for your password file. Just make sure Apache has read access to it.
.htpasswd contain the credentials. You can configure username and password by running:
## if it is the first user use -c param (it create new file / or wipe it if exists)
htpasswd -c /path/to/your/.htpasswd username
## if you want to add more users omit the -c param
In addition we also put the following rule into
.htaccess to deny access to
wp-config.php (which contains sensitive info eg.: the WordPress security keys and the WP database connection details)
deny from all
allow from 192.168.1.1/24 #(replace with your IP address)
and the following one, which Block WP
xmlrpc.php requests which is one of the most common causes for exploits. (read here for more info)
deny from all
allow from 192.168.1.1/24 #(replace with your LAN info)
Sorry I can't directly help with your issue, if the above is not what you are looking for, I hope this link can give you some help : http://artefact.io/brute-force-protection-modsecurity/