WordPress Brute Force Protection: A Complete Guide

Right now, somewhere in the world, a bot is trying to log into your WordPress site. It’s not personal. The bot doesn’t know who you are or what your site is about. It simply knows your site runs WordPress, and it’s systematically guessing passwords until it finds one that works.

This is called a brute force attack, and it’s the most common security threat facing WordPress websites today. Without proper WordPress brute force protection, your site is vulnerable to these relentless automated attacks that run 24 hours a day, 7 days a week.

The good news is that brute force attacks are also one of the easiest threats to defend against. In this guide, you’ll learn exactly what brute force attacks are, how they work, why your WordPress site is a target, and most importantly, how to stop them with proven protection methods.

What Is a Brute Force Attack?

A brute force attack is a trial-and-error method used to crack passwords, login credentials, or encryption keys. The attacker systematically checks all possible combinations until the correct one is found.

Think of it like a thief trying every possible combination on a padlock. Given enough time and attempts, they’ll eventually stumble upon the right numbers. The same principle applies to your WordPress login page.

How Brute Force Attacks Work

Modern brute force attacks against WordPress sites typically follow this pattern:

1. Discovery: Automated scanners identify your site as running WordPress (easy to detect from meta tags, file paths, or the login page itself)
2. Target identification: The bot navigates to /wp-login.php or /wp-admin, which exist on every WordPress site
3. Username enumeration: The attacker tries common usernames like “admin,” “administrator,” or your domain name
4. Password attempts: Using lists of common passwords or leaked credential databases, the bot submits login attempts
5. Repeat: This process continues thousands of times, often from multiple IP addresses

A single bot can attempt hundreds of logins per minute. Coordinated attacks using botnets can scale this to thousands of attempts per second across millions of WordPress sites simultaneously.

Types of Brute Force Attacks

Not all brute force attacks are created equal. Understanding the different types helps you implement the right defenses:

Attack Type	Method	Difficulty to Defend
Simple Brute Force	Tries every possible character combination	Easy (strong passwords defeat it)
Dictionary Attack	Uses lists of common words and passwords	Easy (avoid common passwords)
Credential Stuffing	Uses leaked username/password pairs from other breaches	Medium (unique passwords required)
Reverse Brute Force	Tries one common password against many usernames	Medium (rate limiting helps)
Distributed Attack	Attack spread across thousands of IP addresses	Harder (requires advanced protection)

Why WordPress Sites Are Prime Targets

WordPress powers over 43% of all websites on the internet. This massive market share makes it an attractive target for attackers for several reasons:

Predictable Structure

Every WordPress installation has the same login URL: /wp-login.php. Attackers don’t need to search for your login page because they already know exactly where it is. This predictability makes automated attacks trivially easy to execute at scale.

Common Username Patterns

Many WordPress sites still use “admin” as the administrator username, either because it was the old default or because site owners never changed it. Attackers know this and try “admin” first on nearly every site they target.

Weak Password Habits

Despite years of security education, many users still choose weak passwords. The most common passwords found in breaches include “123456,” “password,” “qwerty,” and similar easily guessed combinations. If your password appears on any common password list, a brute force attack will crack it within seconds.

Valuable Access

A compromised WordPress admin account gives attackers complete control over your website. They can:

• Inject malware that infects your visitors
• Add spam links to boost their own SEO
• Steal customer data from e-commerce sites
• Use your server to send spam emails
• Hold your site for ransom
• Launch attacks against other sites

“The average WordPress site faces over 90,000 brute force login attempts per month. Without proper protection, it’s not a question of if you’ll be targeted, but when.”

Signs Your Site Is Under Attack

How do you know if your WordPress site is experiencing a brute force attack? Here are the telltale signs:

Performance Issues

Brute force attacks consume server resources. Each login attempt requires your server to process the request, check credentials against the database, and return a response. Hundreds or thousands of these requests per minute can slow your site significantly or even crash it.

Increased Server Load

Check your hosting control panel for unusual CPU or memory usage. Spikes during off-peak hours often indicate automated attacks rather than legitimate traffic.

Failed Login Notifications

If you have login monitoring enabled, you’ll see a flood of failed login attempts, often for usernames that don’t exist on your site. Multiple attempts from the same IP address within seconds is a clear indicator of automated attacks.

Lockout Notifications

If you already have basic protection in place, you might receive notifications about locked-out IP addresses. A sudden increase in lockouts suggests an ongoing attack.

Unusual Access Logs

Your server access logs will show repeated POST requests to /wp-login.php from suspicious IP addresses, often from foreign countries or known hosting providers used by attackers.

WordPress Brute Force Protection Methods

Now that you understand the threat, let’s examine the protection methods available. Effective WordPress brute force protection uses multiple layers working together.

1. Login Attempt Limiting

The most fundamental protection is limiting how many login attempts an IP address can make within a time period. After a set number of failures (typically 3-5), the IP is temporarily blocked from attempting further logins.

How it works:

• User fails login attempt #1, #2, #3
• On attempt #4, IP address is locked out for 15-60 minutes
• After lockout expires, the counter resets
• Repeated lockouts can trigger longer or permanent bans

This simple mechanism makes brute force attacks impractical. An attacker who could try 1,000 passwords per minute is now limited to 3-5 attempts every hour.

Get WordPress Brute Force Protection (Free)

Stack Guard includes login attempt limiting, automatic IP lockouts, and more. Protect your WordPress site from brute force attacks in minutes with our free plugin.

Download Stack Guard Free

2. Custom Login URL

By default, every WordPress login page lives at /wp-login.php. Changing this to a custom URL (like /my-secret-login) hides your login page from automated scanners that only check the default location.

This doesn’t stop a determined attacker who specifically targets your site, but it eliminates the vast majority of automated attacks that scan the entire internet looking for WordPress login pages.

3. Two-Factor Authentication (2FA)

Even if an attacker guesses your password, two-factor authentication stops them cold. With 2FA enabled, logging in requires both your password and a time-based code from an authenticator app on your phone.

This means a successful brute force attack against your password is no longer enough. The attacker would also need physical access to your phone, making unauthorized access virtually impossible.

4. CAPTCHA Integration

CAPTCHA challenges verify that login attempts come from humans, not bots. Options include:

• Google reCAPTCHA v2: The “I’m not a robot” checkbox
• Google reCAPTCHA v3: Invisible scoring that runs in the background
• Cloudflare Turnstile: Privacy-focused alternative that doesn’t track users
• hCaptcha: Another privacy-focused option

CAPTCHA is particularly effective because it attacks the economics of brute force attacks. Solving CAPTCHAs at scale requires either human labor (expensive) or specialized AI (complex and detectable).

5. Strong Password Enforcement

The strongest technical protections mean nothing if users choose weak passwords. Password policies should require:

• Minimum 12 characters (longer is better)
• Mix of uppercase and lowercase letters
• At least one number
• At least one special character
• No common words or patterns

Pro Tip

Use a password manager to generate and store strong, unique passwords. A random 20-character password is both more secure and easier to use (with a password manager) than a “clever” password you try to memorize.

6. Blocking Compromised Passwords

Advanced security plugins can check passwords against databases of known breached passwords. The Have I Been Pwned database contains billions of passwords exposed in data breaches. If a user tries to set a password that appears in this database, it’s blocked because attackers already have it in their password lists.

7. IP Allowlisting and Blocklisting

If you and your team always access your site from known IP addresses (like your office), you can allowlist those IPs and block login attempts from everywhere else. This is extremely effective but only practical for sites with a small, consistent group of administrators.

Blocklisting works in reverse: you block known bad IP addresses. This is less effective because attackers can easily switch to new IPs, but it helps reduce attack volume from repeat offenders.

8. Geographic Restrictions

If your business only operates in certain countries, you can block login attempts from everywhere else. For example, a local business in the United States might block login attempts from countries where they have no employees or customers.

Be careful with this approach if you have team members who travel internationally or work remotely from various locations.

Implementing Protection: Step by Step

Here’s a practical approach to implementing WordPress brute force protection on your site:

Step 1: Install a Security Plugin

The easiest way to implement comprehensive protection is with a security plugin. Look for one that includes:

• Login attempt limiting
• Automatic IP lockouts
• Custom login URL option
• Two-factor authentication
• Activity logging

Stack Guard’s free version includes all of these features, making it a solid starting point for WordPress brute force protection.

Step 2: Configure Login Limits

Set reasonable thresholds that stop attackers without locking out legitimate users who mistype their password:

• Failed attempts before lockout: 5 attempts
• Lockout duration: 15-30 minutes
• Lockouts before extended ban: 3 lockouts
• Extended ban duration: 24 hours

Step 3: Enable Two-Factor Authentication

Enable 2FA for all administrator and editor accounts at minimum. Consider requiring it for all user roles that can access the WordPress dashboard.

Popular authenticator apps include:

• Google Authenticator
• Authy
• 1Password
• Microsoft Authenticator

Step 4: Set Up a Custom Login URL

Choose a custom login URL that’s memorable to you but not obvious to attackers. Avoid words like “login,” “admin,” “secret,” or “hidden.”

Important

Bookmark your custom login URL immediately after setting it up. If you forget it, you’ll need to access your site via FTP to disable the security plugin and restore the default login URL.

Step 5: Enforce Strong Passwords

Enable password requirements in your security plugin and consider blocking passwords that appear in breach databases. This prevents users from choosing passwords that attackers already know.

Step 6: Monitor and Adjust

After implementing protection, monitor your security logs for:

• Number of blocked login attempts (confirms protection is working)
• Legitimate users getting locked out (may need to adjust thresholds)
• Patterns in attack sources (might warrant geographic blocking)
• New attack vectors (security is an ongoing process)

What Happens When Protection Fails?

Even with strong protection, it’s important to understand what happens if an attacker does gain access. This helps you implement additional safeguards and respond quickly to incidents.

Signs of Compromise

• New administrator accounts you didn’t create
• Modified theme or plugin files
• Strange content appearing on your site
• Redirects to spam or malicious sites
• Google Search Console warnings about malware
• Hosting provider notifications about suspicious activity

Immediate Response Steps

1. Change all user passwords immediately
2. Review and remove any unknown user accounts
3. Check for modified files (security plugins can help with this)
4. Restore from a clean backup if available
5. Update all plugins, themes, and WordPress core
6. Scan for malware with a security plugin or service
7. Strengthen protection to prevent repeat attacks

Brute Force Protection vs. Other Security Measures

WordPress brute force protection is essential, but it’s just one piece of a complete security strategy. Here’s how it fits with other protections:

Security Layer	What It Protects Against	Brute Force Relevance
Brute Force Protection	Password guessing attacks	Primary defense
Web Application Firewall	SQL injection, XSS, malicious requests	Complements (different attack type)
Malware Scanning	Infected files, backdoors	Detects if brute force succeeded
SSL/HTTPS	Data interception in transit	Protects password transmission
Regular Backups	Data loss, ransomware	Recovery if attack succeeds
Updates	Known vulnerabilities	Prevents alternative attack paths

A comprehensive security approach uses all of these layers together. Brute force protection handles the login page, but attackers might try other entry points if one is blocked.

Frequently Asked Questions

How many login attempts should I allow before lockout?

Five attempts is a reasonable default. This gives legitimate users room for typos while still limiting attackers. If you’re experiencing heavy attacks, you can reduce this to 3 attempts. If legitimate users frequently get locked out, consider increasing to 7-10 attempts.

Will brute force protection slow down my site?

No. In fact, it typically improves performance by blocking the resource-intensive login attempts from attackers. The protection check happens before WordPress processes the full login request, so blocked attempts use minimal server resources.

Can attackers bypass login attempt limits by using multiple IP addresses?

Yes, distributed attacks using botnets can try passwords from thousands of different IP addresses. This is why login limits should be combined with other protections like CAPTCHA, two-factor authentication, and custom login URLs. Each layer makes attacks more difficult.

Is a custom login URL enough protection on its own?

No. While a custom login URL eliminates most automated attacks, it shouldn’t be your only defense. A determined attacker can still discover your login URL through various methods. Always combine it with login limiting, strong passwords, and ideally two-factor authentication.

What if I get locked out of my own site?

Most security plugins provide recovery options like magic links sent via email. If those don’t work, you can access your site via FTP or your hosting control panel and rename the security plugin’s folder to disable it temporarily. This restores the default login behavior so you can get back in.

Conclusion

Brute force attacks are a constant threat to every WordPress site on the internet. Automated bots scan millions of sites daily, trying common passwords and hoping to get lucky. Without WordPress brute force protection, your site is an easy target.

The good news is that these attacks are highly preventable. By implementing login attempt limiting, two-factor authentication, custom login URLs, and strong password requirements, you can make your site essentially immune to brute force attacks.

The key is layered protection. Each security measure adds difficulty for attackers:

• Login limits stop high-volume password guessing
• Custom login URLs hide your login page from automated scanners
• Two-factor authentication makes stolen passwords useless
• Strong passwords resist dictionary attacks
• CAPTCHA blocks automated bot submissions

Together, these protections create a defense that’s simply not worth attacking. Brute force attackers are looking for easy targets. When your site fights back, they move on to the millions of unprotected sites that don’t.

Stop Brute Force Attacks Today

Stack Guard’s free version includes everything you need: login attempt limiting, automatic lockouts, custom login URLs, two-factor authentication, and strong password enforcement. Set it up in minutes.

Get Stack Guard Free

Don’t wait for an attack to take security seriously. The bots are already scanning. Make sure they find a locked door.