Every login page on the internet faces brute force attacks. Right now, automated tools are trying password combinations against your WordPress admin, your hosting control panel, your email account, and any other login interfaces you have. The attacks are constant, automated, and patient.
Most brute force attacks fail because sites have basic defenses in place. But sites without those defenses get cracked regularly. The cost is real. The attackers gain access to your site, and from there they can do almost anything.
This piece covers what brute force attacks actually are, why they keep working against unprotected sites, and the specific defenses that stop them.
What a Brute Force Attack Is
The concept is simple. Try lots of password combinations until one works.
The Basic Approach
An attacker has a target site with a login page. They run an automated tool that submits password attempts. Each attempt that fails just leads to the next attempt. Eventually, if the right password is in the list of attempts, the attacker gets in.
This is not sophisticated. It is patience and computing power.
The Dictionary Attack Variant
Most brute force attacks do not try every possible combination. They use dictionaries of common passwords. “password123.” “admin123.” “welcome2024.” Words and patterns that people actually use.
The dictionary approach is much faster than trying every combination, and it works against weak passwords.
The Credential Stuffing Variant
A related attack uses passwords stolen from other sites. When a site has a data breach, the leaked passwords get traded. Attackers try those passwords against other sites where the same user might have an account.
If you use the same password on multiple sites, a breach at any of them can lead to attacks on all of them.
The Speed of Attacks
A single attacker can try hundreds of passwords per minute from one IP address. With botnets (networks of compromised devices), attacks can come from thousands of IP addresses simultaneously, trying millions of passwords across the network of bots.
Where Brute Force Attacks Happen
WordPress wp-admin is the most common target. Hosting control panels (cPanel, Plesk) get attacked too. FTP and SSH access. Email accounts. Anything with a login form.
Some attacks target multiple services at once. The same credentials might be tried on WordPress, email, and SSH.
Why Brute Force Attacks Keep Working
If the defense is straightforward, why do these attacks still succeed regularly?
Weak Passwords Are Common
Despite years of education, weak passwords persist. “Password123.” “Welcome.” “Companyname2024.” Easy to remember, easy to guess.
Sites where users (especially administrators) pick weak passwords are vulnerable.
Default Usernames
WordPress sites that still use “admin” as the username are easier to attack. The attacker only has to guess the password, not the username.
Many older WordPress installations still have “admin” as the default account.
Login Pages Without Rate Limiting
A login page that accepts unlimited attempts gives attackers unlimited attempts. They keep trying until they succeed.
Without rate limiting, even strong passwords eventually get tried.
Password Reuse Across Sites
When a user picks the same password for multiple sites, a breach at any of them compromises all of them. The attacker can try the same password against many sites.
Slow Update Cycles
Sites without proper attention to security may have outdated default settings. Default usernames. Default password policies. Default login behavior. All exploitable by brute force tools.
How to Defend Against Brute Force
The defenses are well-known and effective.
Strong Passwords
The most basic defense. Every account, especially admin accounts, should have a strong unique password.
Strong means long (at least 16 characters), random, and not based on dictionary words or personal information. Password managers generate and store these passwords so you do not have to remember them.
A strong password is essentially unguessable through brute force in any reasonable time.
Two-Factor Authentication
Even if a password gets guessed, 2FA stops the attacker. The attacker needs the second factor (usually a code from an authenticator app) to complete the login.
For admin accounts, 2FA should be mandatory. The cost of setup is minimal. The protection is large.
WordPress plugins like Wordfence, iThemes Security, and Two Factor handle 2FA setup easily.
Limit Login Attempts
Block IPs that make too many failed login attempts. After 5 to 10 failed attempts, the IP gets blocked for a while. After repeated blocks, the IP gets blocked permanently.
Plugins like Limit Login Attempts Reloaded handle this for WordPress. Most security plugins include this feature.
The attackers move on to easier targets when their attempts get blocked.
Change Default URLs
Default login URLs (wp-login.php for WordPress, /admin/ for many sites) are well-known targets. Changing them to non-standard URLs makes automated attacks harder.
This is not strong defense by itself but adds friction. Plugins like WPS Hide Login change the WordPress login URL.
Change Default Usernames
Make sure no account uses “admin” as the username. If you have an admin account named “admin,” create a new admin account with a different name and delete the old one.
This forces attackers to guess both username and password rather than just the password.
IP Whitelisting
For sites where only specific people need admin access from specific locations, IP whitelisting blocks all logins except from approved IPs.
This is strong defense but requires careful management. People who change networks or work remotely need their IPs updated.
CAPTCHA
Adding CAPTCHA to login forms blocks automated tools. Each login attempt requires solving a CAPTCHA, which automated tools cannot do reliably.
The trade-off is user friction. Real users have to solve CAPTCHAs too. Modern CAPTCHAs (like Google’s reCAPTCHA v3) work in the background without bothering users in most cases.
Web Application Firewall
A WAF can detect and block brute force patterns. Multiple rapid login attempts from one IP, attempts using common dictionary passwords, traffic patterns that match attack tools.
Cloudflare’s free tier includes basic WAF capabilities. Premium WAFs offer more sophisticated protection.
Monitor & Alert
Active monitoring of login attempts catches attacks as they happen. Tools that alert on suspicious login activity let you respond fast.
Security plugins include this functionality. Some hosts provide it as part of managed hosting.
What Happens If Brute Force Succeeds
If despite defenses a brute force attack succeeds, the consequences are serious.
Full Admin Access
The attacker logs in as an admin. They can change anything on the site. Add malicious content. Install backdoors. Delete data. Modify settings.
Plugin & Theme Installation
The attacker can install plugins and themes. Often this is how they install backdoors that let them maintain access even after the original credentials are reset.
User Account Manipulation
The attacker can create new admin accounts for themselves. Even if you reset the password on the compromised account, the new accounts remain.
This is why finding all unauthorized accounts is part of recovery.
Database Access
Through the admin interface, attackers can often access the database. They can read sensitive data, modify content, or insert malicious records.
Email & Other Services
If the attacker has the admin credentials, they may try the same credentials on email, FTP, hosting control panel, and other services. Password reuse extends the damage.
Recovering From a Successful Attack
If you discover that brute force has succeeded, response matters.
Lock Down Immediately
Reset all passwords. Change them to strong unique values.
Disable any admin accounts you do not recognize. Check thoroughly because attackers often create multiple accounts.
Disable the compromised user account if it is a regular account.
Check for Backdoors
Attackers usually install backdoors so they can return even after passwords are changed. Look for unfamiliar plugins, unfamiliar files, unauthorized administrator accounts.
Malware scanners like Wordfence, Sucuri, and MalCare catch most backdoors.
Restore From Clean Backup
For confirmed compromises, restoring from a backup made before the attack is often the safest path. The restored site is clean. Any backdoors are gone.
After restoring, apply the security improvements that would have prevented the attack.
Notify Where Required
If sensitive data was exposed, notification requirements may apply. Customer data, payment information, regulated data. Consult legal counsel.
Investigate
Understand how the attack succeeded. Was it a weak password? Missing 2FA? No rate limiting? The investigation informs better defenses going forward.
Defending Multiple Services
Brute force attacks target every login interface. The defenses need to extend beyond just the website.
Hosting Control Panel
cPanel, Plesk, and other hosting control panels need strong protection. The control panel often has more privileges than the website admin.
Strong passwords. Two-factor authentication if available. IP whitelisting if practical.
Email Accounts
Email accounts often have access to password reset emails for other services. Compromised email leads to compromise of everything connected to the email.
Strong passwords and 2FA on email. Use dedicated email services like Google Workspace or Microsoft 365 that include strong security.
SSH & FTP
For technical users, SSH and FTP access need protection. SSH should use key-based authentication, not passwords. FTP should be SFTP or FTPS, not unencrypted FTP.
Disable root SSH login. Change SSH ports from defaults. Use fail2ban or similar to block repeated failed attempts.
Database
Direct database access should be restricted to specific IPs. Database passwords should be strong. Database should not be exposed to the public internet.
Closing Thoughts on Login Protection
Brute force attacks are constant but the defenses are straightforward. Strong passwords. Two-factor authentication. Rate limiting. These three measures alone stop most brute force attempts.
For most sites, the implementation is not difficult. Password managers handle the password problem. 2FA plugins handle the second factor. Security plugins handle the rate limiting. The setup is hours, not days.
The cost of defense is small. The cost of being compromised is large. The math is overwhelming in favor of investing in defense.
Sites that have not implemented basic brute force defenses are easy targets. The attackers find them. The compromises happen. The recoveries are painful.
The path forward is clear. Audit your authentication practices. Strengthen weak passwords. Enable 2FA on admin accounts. Install plugins that handle rate limiting and login monitoring. The work is bounded and the protection is real.
If your site has not been hardened against brute force attacks, this is one of the highest-priority security improvements available. The attackers are constantly testing. The question is what they find when they test your site. With the right defenses in place, they find nothing they can exploit and move on to easier targets.
