Recently on my drupal 7 site happens that i find the admin account blocked. Looking to the flood table i see a lot of failed login attempts from ip "1-127.0.0.1". It's an external attack or something not working in my site? The fact that the ip the request comes from is 'localhost' is confusing me. In both cases, how to deal with this problem?
After attempt five login drupal block account automatically
Install the Flood module flood_control
Enable the Flood module
Go to admin/settings/system/Flood control
Change the "Failed login (username) window" from 6 hours to None
This project is intended to add an administration interface for hidden flood control variables in Drupal 7, like the login attempt limiters and any future hidden variables.
This module makes it possible for site administrators to remove ip-adresses from the flood table, or to remove all ip-adresses from the table depending on the event type.