Brute-force login attacks, how to defend yourself
A brute-force ("force") attack is when a program automatically tries hundreds and thousands of login and password combinations until it hits the right one. It does not need to know you or single you out, bots scan the whole internet and knock on every login panel they find. If the password is weak, it is only a matter of time.
How to tell it is happening
The symptoms can be subtle: the site sometimes slows down, the server logs show hundreds of login attempts from different addresses, emails about a "locked account" arrive. Sometimes the first signal is only the moment you cannot log in, because someone changed the password.
Five things that genuinely help
- A strong, unique password for the panel, long, ideally from a password manager.
- Two-factor login (2FA): even knowing the password, an attacker cannot get in without the code.
- A failed-attempt limit: after a few errors the account or address is temporarily blocked.
- No account named "admin": do not do half the bots' work for them.
- Hiding/changing the login address: makes it harder for bots to find the panel.
Just changing to a strong password and enabling 2FA eliminates the vast majority of such attacks. Those are two things worth doing today.
Blocking at the server level and XML-RPC
Beyond WordPress itself, it is worth limiting login attempts at the server level and disabling XML-RPC, which allows passwords to be guessed in bulk. This closes the route that bypasses the normal login form.
Peace of mind instead of babysitting
Constantly watching logs and blocks is a full-time job. That is why, as part of ongoing care, we set these protections up once and properly, and monitor unusual access attempts.
Want to check whether your panel is properly protected? Reach out, we will review your login security.