WordPress Brute Force Attacks: 3 Ways to Secure Your Site

Why WordPress Brute Force Attacks Are Every Website Owner’s Nightmare

WordPress brute force attacks are a relentless and pervasive threat in today’s digital landscape. Imagine an endless, automated siege on your website’s front door. Hackers deploy armies of bots that systematically try thousands, or even millions, of username and password combinations on your login page every hour. Their goal is simple: to force their way into your administrative dashboard and seize control.

Quick Answer: What You Need to Know About WordPress Brute Force Attacks

What it is: Automated bots relentlessly trying thousands of login combinations on your wp-login.php page.
Why WordPress: It powers over 40% of all websites with a standard login URL, making it a massive and uniform target for automated attacks.
Common damage: Complete site takeover, data theft of user information, malware injection, SEO spam that destroys rankings, and server crashes from resource exhaustion.
Key prevention: A multi-layered strategy including strong, unique passwords, two-factor authentication (2FA), limiting login attempts, and a web application firewall (WAF).
If compromised: Isolate the site immediately, change all credentials (WordPress, hosting, database), scan for malware and backdoors, and restore from a verified clean backup.

Unlike sophisticated hacks that exploit specific code vulnerabilities, brute force attacks target the most fundamental and often weakest link in any security chain: human-created login credentials. The sheer scale of these attacks is staggering. A single website can be hit with hundreds of thousands of failed login attempts in a day, a digital onslaught that can easily overwhelm your server’s resources and crash your site, even if the attackers never guess the password.

Your site doesn’t need to be large or famous to become a target. Attackers use vast botnets—global networks of compromised computers, routers, and IoT devices—to cast an incredibly wide net. They aren’t looking for a specific target; they are scanning the internet for any WordPress site with a weak password or a common vulnerability. The good news is that these attacks, while persistent, are almost entirely preventable with a robust, layered security posture.

I’m Kevin Gallagher, and over my fifteen years of managing and securing WordPress websites, I’ve helped hundreds of clients at wpOncall defend against these very attacks and recover from devastating breaches. I’ve seen what works to stop them cold and what happens when defenses are neglected.

What is a WordPress Brute Force Attack and How Does It Work?

A WordPress brute force attack is a methodical, trial-and-error assault used to find login credentials. Attackers use automated scripts and botnets to submit an enormous volume of username and password combinations to your site’s login form, which is typically located at the wp-login.php file.

These bots are not just guessing randomly; they employ several clever techniques:

Dictionary Attacks: This is the most basic method. The bot uses a pre-compiled list, or “dictionary,” containing millions of the most commonly used passwords (e.g., “123456,” “password,” “qwerty”) and common usernames (e.g., “admin,” “test,” the site’s domain name). It systematically tries every password in the dictionary for a given username.
Credential Stuffing: This highly effective technique leverages the fact that people reuse passwords across multiple websites. Attackers obtain massive lists of usernames and passwords leaked from data breaches of other popular services (like LinkedIn, Adobe, etc.). Their bots then “stuff” these stolen credentials into your WordPress login form, betting that you reused the same password on your site.
Reverse Brute Force Attacks: Instead of trying many passwords for one username, this attack flips the script. The bot tries a single, very common password (like “password123”) against a long list of potential usernames, which can often be easily finded through user enumeration techniques.

Another critical vector for these attacks is the XML-RPC interface. XML-RPC is a protocol that allows external applications (like the old WordPress mobile app or other remote publishing tools) to connect to and interact with your WordPress site. A specific function within this interface, system.multicall, allows an attacker to test hundreds of different username and password combinations in a single HTTP request. This makes their attack incredibly efficient and allows them to bypass some security plugins that only monitor individual login attempts on the wp-login.php page. These attacks are almost always launched from massive botnets, making it impossible to stop them by simply banning a single IP address, as the next attempt will come from a different IP somewhere else in the world.

Why Are WordPress Sites a Prime Target?

WordPress’s immense popularity is, paradoxically, its biggest vulnerability when it comes to automated attacks. Powering over 40% of all websites, it represents a vast, homogeneous target for attackers. They can develop one tool and use it to attack millions of sites simultaneously.

Several factors make WordPress an especially attractive target:

Standardized Login URL: By default, every WordPress site in the world has its login page at wp-login.php. This gives bots a fixed, predictable target to aim for. It’s the digital equivalent of every house having the same model of lock on the front door.
Default Usernames and User Enumeration: In older versions, WordPress created a default “admin” username, which is the first thing every attacker tries. While this is no longer the default, many older sites still have this user. Furthermore, WordPress can sometimes make it easy to find valid usernames through a technique called user enumeration (e.g., by visiting yourdomain.com/?author=1), giving attackers a verified list of targets.
Vast Plugin and Theme Ecosystem: The thousands of available plugins and themes are a core strength of WordPress, but also a significant security risk. Each plugin is a new piece of software added to your site, and if it’s poorly coded or not updated, it can introduce a vulnerability that attackers can exploit. A single flaw in a popular plugin can instantly make millions of websites vulnerable.

These attacks are not personal. Your site isn’t being targeted because it’s famous or valuable; it’s being targeted because it’s a WordPress site that exists on the internet. Attackers are playing a numbers game, and they win by exploiting the low-hanging fruit of common, easy-to-find weaknesses.

The Damaging Impact of a Successful Attack

A successful WordPress brute force attack is not just an inconvenience; it can be a catastrophic event for your business, with far-reaching consequences.

Complete Data Theft: Once inside, attackers have access to everything. They can steal sensitive user information (names, emails, passwords), private customer lists, and even payment details if you run an e-commerce store. This can lead to massive legal and financial liabilities under data privacy laws like GDPR and CCPA.
Malicious Code Injection and Backdoors: Hackers rarely stop at just stealing data. They will inject malicious code to serve their own purposes. This can include adding hidden “backdoors” that give them persistent access even if you change your password, installing scripts that use your server to attack other websites, or placing malware that infects your visitors’ computers.
Devastating SEO Spam: A common outcome is for hackers to use your site’s authority to promote their own illicit products. They will inject hidden links and pages for spammy keywords (often known as the “pharma hack” or “Japanese keyword hack”). This causes search engines like Google to blacklist your site, destroying your search rankings and organic traffic overnight.
Website Defacement and Brand Damage: In some cases, attackers will simply deface your website, replacing your content with their own messages. This public vandalism instantly shatters your brand’s credibility and erodes the trust you’ve built with your audience.
Server Overload and Hosting Suspension: Even an unsuccessful brute force attack can be damaging. The constant flood of login requests consumes significant server CPU and memory. This will slow your site to a crawl for legitimate visitors and can eventually cause it to crash entirely. Many web hosts will suspend your account for excessive resource usage to protect their other customers, taking your site offline completely.

The cleanup process is often complex, costly, and time-consuming, requiring expert help to ensure all malicious code and backdoors are removed. To see what this damage looks like, view our article on What a Hacked WordPress Site Looks Like.

Essential Strategies to Prevent WordPress Brute Force Attacks

The good news about WordPress brute force attacks is that they are highly preventable. The most effective defense is not a single tool or trick, but a layered security approach. This strategy, known as “defense in depth,” creates multiple, independent barriers that an attacker must overcome. Think of it like defending a castle: you have a moat (a firewall), high walls (server hardening), guards at the gate (login protection), and a secret key to the throne room (a strong password with 2FA). If an attacker manages to bypass one layer, they are likely to be stopped by the next.

At wpOncall, we implement these proactive defenses across three critical levels: foundational user security, application-level hardening, and server-level protection. Most of these measures can be implemented by any diligent website owner. The key is to apply them consistently and understand that security is an ongoing process, not a one-time setup. For a complete overview, the official Hardening WordPress guide from WordPress.org is an excellent resource.

Foundational User Security: Your First and Most Critical Line of Defense

Brute force attacks are designed to exploit human weaknesses, such as our tendency to use simple, memorable passwords and reuse them across different services. Therefore, addressing these human factors is the most important line of defense.

Crafting Unbreakable Passwords

A strong password is your primary shield. Modern password guidance, such as that from the National Institute of Standards and Technology (NIST), emphasizes length and unpredictability over forced complexity.

Length is Strength: A long password is exponentially harder to crack than a short, complex one. Aim for a minimum of 16 characters, but longer is always better.
Use Passphrases: Instead of random characters like Tr0ub4dor&3, which are hard to remember, use a memorable but random passphrase like Coffee-Sunrise-Mountain-42. It’s both stronger and easier for you to recall.
Avoid Predictability: Never use personal information like birthdays, pet names, or common words and substitutions. Attackers’ dictionaries are wise to these tricks.
Accept a Password Manager: The single best thing you can do for your password security is to use a password manager like LastPass, 1Password, or Bitwarden. These tools generate and securely store unique, complex passwords for every site you use. You only need to remember one strong master password.

Implementing Two-Factor Authentication (2FA)

2FA is arguably the single most effective measure against brute force attacks. It adds a second layer of verification, requiring something you have (like your phone) in addition to something you know (your password). Even if an attacker steals your password, they cannot log in without physical access to your second factor.

Authenticator Apps (Recommended): Apps like Google Authenticator, Authy, or Microsoft Authenticator generate a time-sensitive, one-time code on your phone. This is the most secure and popular method.
Security Keys (Maximum Security): For ultimate protection, physical hardware keys like a YubiKey use public-key cryptography to provide nearly impenetrable security. They are resistant to phishing and are the gold standard.
SMS Codes (Use with Caution): While better than nothing, receiving codes via text message is the least secure 2FA method due to the risk of “SIM swapping” attacks.

WordPress requires a security plugin like Wordfence or Solid Security to enable 2FA, but the minimal setup effort provides a massive return in security.

Prudent User Account Management

Good account hygiene significantly reduces your site’s attack surface.

Change the ‘admin’ Username: The username “admin” is a universal target. If your site still uses it, create a new administrator account with a unique, non-obvious name, transfer all content to the new user, and then delete the old ‘admin’ account.
Remove Unused Accounts: Regularly audit your user list in the WordPress dashboard. Delete any accounts that are no longer needed, such as those for former employees or temporary freelancers.
Apply the Principle of Least Privilege: Assign users the minimum role necessary for their job. An author who only needs to write posts should not have an Administrator role. Understanding WordPress roles (Administrator, Editor, Author, Contributor, Subscriber) is key to limiting potential damage if an account is compromised.

Application-Level Hardening: Using WordPress to Protect Itself

You can configure WordPress and its plugins to actively resist attacks, making them slow, inefficient, and ultimately futile for bots.

By default, WordPress allows unlimited login attempts from a single IP address. This is a gift to brute force bots. A security plugin can limit these attempts, temporarily locking out any IP address that fails to log in more than a few times within a short period. This simple change makes automated guessing impractical, as bots can no longer try thousands of passwords in rapid succession.

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) adds a simple test to your login and comment forms to prove the user is human. Modern systems like Google’s reCAPTCHA v3 are often invisible to legitimate users, analyzing behavior in the background to block bots without adding friction.

Changing your login URL from the default wp-login.php to a custom, unique address (e.g., my-secret-login) can significantly reduce the number of automated hits from basic bots. They are programmed to scan for the default URL, so if they can’t find it, they often move on. However, this is “security by obscurity” and is not a foolproof solution. A determined attacker can still find the new URL, so it must be used in combination with other, stronger security layers.

Disabling XML-RPC

For most modern websites, the XML-RPC functionality is legacy technology that is no longer needed. It has been largely replaced by the more secure REST API. Because it’s a major target for amplified brute force attacks, you should disable it unless you have a specific, older application that requires it. You can disable it by adding a small code snippet to your .htaccess file or by using a security plugin.

Advanced Server-Level and Firewall Defenses

The most powerful defenses operate at the server or network level, blocking threats before they can even reach your WordPress application.

Leveraging a Web Application Firewall (WAF)

A WAF is an intelligent filter that sits between your website and the internet. It analyzes incoming traffic and blocks malicious requests—like brute force attempts, SQL injection, and cross-site scripting—based on a set of rules. A DNS-level WAF (from services like Cloudflare or Sucuri) is particularly effective because it blocks threats at the network edge, preventing them from ever consuming your server’s resources. This is a core component of any robust security strategy.

Hardening Your Server with .htaccess

For servers running Apache, the .htaccess file is a powerful configuration file that can enforce security rules before WordPress even loads. You can use it to:

Password-protect your wp-admin directory: This adds a second, server-level login prompt that operates independently of WordPress. A bot would need to bypass two separate authentication systems. You can use an online htpasswd generator to create the necessary password file.
Restrict access by IP address: If you and your team only log in from fixed, static IP addresses, you can create a rule to block all other IPs from accessing your wp-login.php file. This is highly effective but not practical for users who travel or have dynamic IPs.

Protection Method	Security Level	User Impact
Password protect wp-admin	High	Moderate – requires a second password
IP address restrictions	Very High	High – blocks access from other locations
Block no-referrer requests	Medium	Low – minimal impact on legitimate users

Understanding Common Misconceptions

“Changing the login URL is enough.” It’s not. It reduces noise from low-level bots, but a determined attacker can find the new URL by scanning your site’s code. It’s a weak, single layer of defense.
“A unique username is more important than a strong password.” False. While you should change the “admin” user, attackers can easily find usernames through enumeration. The password is, and always will be, the more critical credential.
“I can just block the bad IPs myself.” This is futile. Modern brute force attacks come from botnets using thousands of different, constantly changing IP addresses from all over the world. Manual blocking is an impossible game of whack-a-mole.
“One security plugin is all I need.” A single plugin is a great start, but true security comes from a multi-layered approach that combines strong user practices (passwords, 2FA), application hardening (limit login attempts), and network-level defenses (WAF).