Practical guides on websites, online stores, and getting found on Google — written for business owners, not developers.
Tell us about your business today — get a free quote within 24 hours. No pressure, no confusing tech talk.
Tell us about your business today — get a free quote within 24 hours. No pressure, no confusing tech talk.
A brute force attack is a hacker's program trying login after login, thousands or millions of combinations, until one works.
A brute force attack is a hacker's program trying login after login, thousands or millions of combinations, until one works. No skill needed, just patience and a script.
It happens constantly. One WordPress site we manage took over 9,700 login-related requests in two weeks, a third of them automated break-in attempts like this.
Left unprotected, a successful one can hand a hacker your customer data, your domain's reputation, or months of quiet access to your site. This guide covers the types of brute force attacks, why hackers bother, and exactly how to stop them, plugins included.
A brute force attack is automated. Software, not a person, sits at your login page and works through password after password until one lets it in. There is no hacking skill involved and no clever exploit, just repetition at a scale no human could manage by hand. The only question is whether your defenses make that repetition too slow or too costly to be worth it.
Not every brute force attack works the same way, and knowing the difference helps you see why some defenses matter more than others.
Simple brute force attack. The software tries every possible character combination for a password, shortest first, working its way up. It works eventually against short or simple passwords, but a long, random one can make it take far too long to be worth the attacker's time.
Dictionary attack. Instead of every combination, the software works through lists of common passwords and real words, often with small tweaks like a capital letter or a number at the end. Because so many people reuse simple passwords, this is faster and far more common than a pure simple brute force attack.
Credential stuffing. The hacker already has real username-password pairs, usually leaked from a breach on a completely different website. If your password is one you have used anywhere else, this attack does not need to guess anything. It just tries what already works.
Reverse brute force attack. This flips the usual method. Instead of guessing many passwords for one username, the hacker starts with a single common password and tries it against a large list of usernames, hoping it matches even one account.
A successful brute force attack is not the end goal, it is the door. Once a hacker is inside your WordPress admin, the real payoff starts: installing malware that redirects your visitors to scam pages, siphoning customer names and order details, sending spam from your domain until your host suspends your email, or quietly reselling admin access to your site on a hacked-site marketplace.
None of that shows up right away. In one real incident we investigated, a hacker held quiet access to a site for months, through rogue admin accounts nobody had created on purpose, before anyone noticed anything was wrong.
That is the actual cost of skipping protection. Not just a compromised login, but a cleanup bill, a Google blacklist warning that kills your traffic overnight, and possibly a customer data breach you have to disclose. Prevention is not peace of mind. It is cheaper than the alternative.
WordPress runs a huge share of every website on the internet, and every single install uses the same predictable login page plus a second entry point, /xmlrpc.php, that most site owners have never heard of. That consistency is exactly what makes it an efficient target. A bot built to attack one WordPress site works, with no changes, against millions of others. None of this is personal. Your site is not picked out, it is just on the list, which is why the defense has to stay on permanently, not just while you are paying attention.
A few signs are worth watching for. Your site suddenly feels slow, or your host warns about server load. A flood of failed login emails you did not expect. Login attempts or traffic from countries that have nothing to do with your actual visitors. A warning from your hosting provider about unusual account activity.
That last pattern, repeated logins from places with no connection to your real audience, is exactly what showed up in the firewall numbers mentioned earlier.
Limiting login attempts is the single highest-leverage step you can take, and it takes minutes. Once a visitor fails to log in a set number of times, usually three to five, the plugin locks that IP address out for a set period instead of letting the software try forever. A brute force attack depends on unlimited tries. Take that away, and most attempts fail before they get anywhere close to a real password. Limit Login Attempts Reloaded and Loginizer both do this well, and both have free versions that cover what a single site needs.
A strong password stops guessing. It does not stop credential stuffing, where the attacker already has a real password from a breach somewhere else entirely. Two-factor authentication is what closes that gap. Even if the password is correct, the login also asks for a code from your phone, something the attacker does not have.
This is also the step people skip even when they know better, and we have done it ourselves on accounts we manage. If you get one thing from this section, make it this one. Plugins like miniOrange or Wordfence's built-in 2FA take about five minutes to set up.
If your username is still admin or administrator, change it. That is half the login guessed before an attacker even starts. Pair it with a password that is long, random, and used nowhere else, since a reused password is exactly what credential stuffing depends on. If you manage more than one site, a password manager makes this practical instead of a hassle.
A CAPTCHA or honeypot field on the login form stops a lot of this before it even becomes a login attempt. A CAPTCHA asks a visitor to prove they are human with a quick challenge. A honeypot is quieter, an invisible field real visitors never see or fill in, but that most bots fill in automatically, which flags them instantly. Honeypots add no friction for actual users, which makes them the easier sell if you are worried about login-page annoyance. Most login-limiting plugins include one or the other as an option.
A firewall filters bad traffic before it does anything, and there are two different kinds worth knowing apart. A security plugin's firewall runs inside WordPress, which means the request still reaches your server before it gets blocked. An edge firewall, like Cloudflare or a similar service sitting in front of your hosting, stops the request before your server ever sees it at all.
For a low-traffic personal site, the plugin-level firewall is usually enough. For a business site, a store, or anything where server load or downtime costs you money, pair it with an edge firewall. The difference shows up exactly when you need it most, during a real attack, not during a quiet week.
Most WordPress owners have never heard of /xmlrpc.php, but it is a second login-adjacent door that bots probe just as often as the main one. If you do not use it for anything like the WordPress mobile app or remote publishing, disabling it closes that door entirely. We cover the safe way to do this, since disabling it the wrong way can break legitimate integrations, in a dedicated guide.
Changing your login URL from the default /wp-login.php to something only you know cuts the volume of automated scans dramatically, since most bots are built to hit that one predictable address and nothing else. That is a real, measurable benefit for server load and log noise.
What it does not do is stop anyone who already has your real URL, whether from a data breach or a deliberate look at your site. Treat this as one useful layer that reduces noise, not the thing standing between you and an attacker.
Blocking traffic from countries you have no business relationship with removes a real share of automated attempts, and most firewalls make this a simple toggle per country.
The catch: some tools suggest countries to block automatically based on traffic patterns, and that suggestion has no idea where your actual customers are. We have seen a geo-blocking recommendation flag a country that turned out to be a client's own primary market. Check any automated suggestion against your real audience before you act on it, every time.
This one is well covered everywhere, so briefly: outdated software is a separate risk from brute force, but a hacker who gets in through a guessed password will often look for an outdated plugin next to make that access permanent. Keep updates current.
If you suspect an attack is happening right now, a few checks matter more than others. Open your WordPress users list and look for any admin account you do not recognize, even one you think you created and forgot about. Force a password reset for every admin account, not just the one you use. Turn on login lockouts immediately if you have not already. Check which files changed most recently if your host gives you that visibility.
If anything beyond login attempts looks wrong, a plugin you did not install, content you did not write, stop guessing and get help.
If you run one site and do not have a developer on call, a lightweight combination covers most of what matters: a login-limiting plugin, a 2FA plugin, and keeping everything updated. That is a real, working defense for a personal site or a small business site, and most of it is free.
If you are a freelancer or agency managing sites for clients, the calculation changes. A single dashboard tool that covers firewall, scanning, and login protection across every site you manage, Wordfence, Sucuri, and MalCare are the three worth comparing, earns its subscription cost back in the hours it saves you from checking each site individually.
Free tools cover the basics. Paid tools earn their keep once you are responsible for more than one site.
Yes, if the password is weak or reused and nothing limits login attempts. It is rarely a fast process, which is exactly why limiting attempts and using 2FA work so well. They make the attack too slow to be worth finishing.
It reduces the volume dramatically by cutting out automated scans built for the default URL, but it does not stop someone who already has your real one. Treat it as one layer, not the whole defense.
Depends on the plugin. Most security plugin firewalls run at the application level, which still lets requests reach your server. An edge firewall like Cloudflare stops them earlier, and the two work well together on any site that matters to your income.
Check for admin accounts you did not create, unexpected file changes, or content on your site you did not write. A string of failed logins followed by one success in your login log is the clearest sign.
None of this happens because someone picked your site out. It happens because your site exists, runs WordPress, and has a login page, which is enough. The defenses in this guide are not complicated, and most of them take an afternoon to set up once and forget about. If you would rather have someone else confirm it is actually locked down, that is what a security audit service or maintenance service is for.
Written by AppDeel Editorial Team
The AppDeel Editorial Team draws on designers, developers, SEO, security, growth marketing, social media and AI automation specialists who have worked with businesses for over ten years. Every article is researched thoroughly before publishing and reviewed by whichever specialist actually does that work. The team is led by Azizul Hakim, founder of AppDeel.
Read more posts by AppDeel Editorial Team →WordPress supply chain attacks turned 30+ trusted plugins malicious in 2026. How they happen, how to spot one, and why updating alone isn't enough.
Japanese characters showing up in your Google results? Here is how to confirm the Japanese keyword hack, clean it properly, and get the spam pages deindexed.
Your WordPress site is redirecting to spam for visitors but looks fine to you. Here is how to prove it, find where the code hides, remove it, and confirm it is gone.
Most landing page advice assumes you bought the traffic. Where the button goes, what it says, and how much to explain first, when nobody clicked an ad.
Tell us about your business today — get a free quote within 24 hours. No pressure, no confusing tech talk.
