What Brute force attack means
Login pages, especially well-known ones like the WordPress admin, are constantly hit by brute force bots. Strong unique passwords, MFA, login limits and a WAF stop most of them. Weak admin passwords remain a common cause of hacked sites.
Why it matters for your website
Login pages on popular platforms are constant targets for automated password guessing. A successful attack can let someone deface your site, steal data or plant malware. Even failed attempts can slow your server, so basic defenses protect both security and performance.
Example
A WordPress site for a local gym sees thousands of login attempts against the 'admin' username. After adding login rate limits and two-factor authentication, the attempts stop getting anywhere.
Tips
- Use long, unique passwords stored in a password manager.
- Turn on two-factor authentication for all admin logins.
- Limit failed login attempts or add a firewall that blocks repeat offenders.
Common mistakes
- Keeping a predictable username like 'admin' paired with a short password.
- Relying on hiding the login URL as your only defense.
Questions about Brute force attack
What is Brute force attack?
Guessing a password by automatically trying huge numbers of combinations.
How do I know if my site is under a brute force attack?
Signs include many failed login alerts, security plugin reports of blocked IPs and slowdowns around the login page. Server logs will show repeated requests to login URLs.
Does two-factor authentication stop brute force attacks?
It greatly reduces the risk, because guessing the password alone is not enough to get in. You should still limit login attempts to reduce server load.
