Brute Force Attack

Right now, somewhere on the Internet, a bot is probably trying to log in to a WordPress site with the password "123456". This is a brute force attack. A hacker uses software to guess usernames and passwords again and again until one combination works.

Since WordPress runs a huge number of websites, its login page is a favorite target. Let us see how these attacks work and how you can stop them.

What is a Brute Force Attack?

Imagine a thief standing at your front door with a giant key ring. He tries one key, then the next, then the next, without ever getting tired. Bots do exactly that with your login page.

Most attacks hit wp-login.php, the default login page. Some also target xmlrpc.php, an older file that lets apps talk to your site and can accept many password guesses in a single request.

Why should you care?

Even if the bots never guess right, thousands of login attempts can slow down your server and eat up your hosting resources. If they do guess right, they get the same access as the account they broke into.

WordPress does not limit login attempts on its own. So, the protection is your job.

How to protect your site from brute force attacks

• Use a long, unique password for every account. A password manager makes this pretty easy.
• Don't use "admin" or your site name as a username.
• Install a plugin that limits login attempts and blocks repeat offenders.
• Turn on two-factor authentication for every account with publishing or admin access.
• Move the login page to a custom address. Our guide on how to change the WordPress login URL shows two methods.
• Turn off XML-RPC if no app or service on your site needs it. Here is how to enable or disable XML-RPC in WordPress.

A firewall at the server or DNS level can also block known attack bots before they even reach your login page.

Brute force attacks are noisy, but a few small changes make them almost harmless. That's it for today. If you have any doubts, ask in the comment box below.