How to Prevent Brute Force Attacks on Your WordPress Site

C. Why WordPress is a Target

✅ WordPress’s popularity makes it attractive to hackers. ✅ Many users fail to update passwords or security settings. ✅ Default login pages (e.g., /wp-login.php) are easy to find. Try setting your login page to a childhood memory or something you can remember but no one else will guess.

2. Signs Your WordPress Site is Under a Brute Force Attack

A. Increased Login Attempts

✅ Multiple failed login attempts from different IPs. ✅ Unusual spikes in server resource usage.

B. Locked Out of WordPress Admin

✅ If hackers guess your password, you might be locked out of your own site. ✅ Unusual new admin accounts may appear.

C. Server Slowdowns or Downtime

✅ Continuous login attempts can slow down or crash your site. ✅ High CPU usage in your hosting dashboard could be a red flag.

3. How to Prevent Brute Force Attacks on WordPress

A. Strengthen Your Login Credentials

✅ Use long, complex passwords with letters, numbers, and symbols. ✅ Avoid common usernames like “admin” or “webmaster”. ✅ Consider using passphrases instead of traditional passwords.

B. Enable Two-Factor Authentication (2FA)

✅ Requires a second verification step (e.g., SMS or authenticator app). ✅ Even if attackers guess your password, they can’t log in without the second factor. ✅ Plugins like Google Authenticator, Authy, or Wordfence Login Security can help. I cannot stress this enough. Yes, it's a pain to enter these codes everytime you want to login, but it will save you tons of grief down the road. so it's well worth it.

C. Limit Login Attempts

✅ Install security plugins like Limit Login Attempts Reloaded or WP Cerber. ✅ Restrict failed login attempts to 3-5 per IP before temporary lockout. ✅ Helps prevent bots from repeatedly trying passwords. I have it set to 2.  You get 2 attempts before you are permanently banned.

D. Change the Default Login URL

✅ Move the WordPress login page from /wp-admin or /wp-login.php. ✅ Plugins like WPS Hide Login or iThemes Security can do this. ✅ Prevents automated bots from easily finding the login page.  If you are like me, plugins cause bloat.  Here is how to code it yourself.

• Add constant to wp-config.php
  
  

define('WP_ADMIN_DIR', 'secret-folder');

define( 'ADMIN_COOKIE_PATH', SITECOOKIEPATH . WP_ADMIN_DIR);

• Add below filter to functions.php

add_filter('site_url',  'wpadmin_filter', 10, 3);

function wpadmin_filter( $url, $path, $orig_scheme ) {

    $old  = array( "/(wp-admin)/");

    $admin_dir = WP_ADMIN_DIR;

    $new  = array($admin_dir);

    return preg_replace( $old, $new, $url, 1);

}

• Add below line to .htaccess file
  
  

RewriteRule ^secret-folder/(.*) wp-admin/$1?%{QUERY_STRING} [L]

Easy, huh? just replace secret-folder with anything you want. Remember secret folder is listed twice. These must match in order to work.

E. Use a CAPTCHA on Login Pages

✅ Google reCAPTCHA blocks bot traffic while allowing real users. ✅ Protects against automated brute force attacks. ✅ Popular plugins: reCaptcha by BestWebSoft, hCaptcha, and Login No Captcha reCAPTCHA.

F. Implement IP Blacklisting & Geoblocking

✅ Block known malicious IP addresses using Wordfence or Sucuri. ✅ Restrict access from countries where you don’t expect login attempts. ✅ Works well for local businesses that don’t need global access.

G. Enable Multi-User Role Restrictions

✅ Give users only necessary permissions (avoid giving admin access to everyone). ✅ Require strong passwords for all accounts, not just admins. ✅ Use security monitoring tools to track suspicious user activity.

H. Install a WordPress Security Plugin

✅ Plugins like Wordfence, Sucuri Security, iThemes Security, and MalCare provide multiple layers of protection. ✅ Features include firewalls, malware scanning, and brute force prevention.

I. Secure Your Hosting & Server

✅ Use managed WordPress hosting with built-in security (e.g., Kinsta, WP Engine, SiteGround). ✅ Regularly update PHP versions and use SSL encryption. ✅ Set up a web application firewall (WAF) to filter bad traffic.

4. How to Recover from a Brute Force Attack

A. Regain Admin Access

✅ If locked out, reset the password via phpMyAdmin or FTP. ✅ Check for new suspicious admin users and remove them.

B. Restore a Clean Backup

✅ If hackers gained access, restore your website from a recent backup. ✅ Ensure backups are stored offsite or on cloud services. ✅ Popular backup plugins: UpdraftPlus, Jetpack Backup, BlogVault.

C. Scan for Malware & Remove Suspicious Files