How to Stop Brute Force Attacks on WordPress?

On December 18, 2018, WordPress sites experienced the highest number of brute force attacks that happened as of that date. Mark Maunder, the founder and CEO of Wordfence, said that this aggressive campaign culminated with 14 million attacks on WordPress sites per hour.

You want your WordPress site to be protected from brute force attacks. Brute force attacks can slow your website down, stop people from visiting it, crack your password, and install malicious software on your site.

Defining a Brute Force Attack

This is a method of hacking that uses a trial and error system to compromise a network, a website, or a computer system. To accomplish this, hackers use automated software that sends huge numbers of requests against a specific system. The software is trying to guess passwords or PIN codes to gain access to the system.

When a brute force attack is successful, hackers could get access to your WordPress website's admin area. They could install malware, they could steal your information, or they could even delete your entire site. Even if the attack is unsuccessful, when you get too many requests, your website's hosting servers could crash, rendering them inoperable.

Now that we know what a brute force attack is, let’s examine a few steps you can take to protect yourself from it.

Use a WordPress Firewall Plug-In

When you use a website firewall solution, you are able to filter out bad traffic and prevent it from gaining access to your site. Website firewalls can be divided into two categories.

Application Level Firewalls

This type of firewall plugin examines traffic when it gets to your server. This happens before it loads the majority of your WordPress scripts. This is not considered the most efficient method of protection against a brute force attack because the server load could still be negatively affected.

DNS Level Website Firewall

This is the firewall that routes website traffic through cloud proxy servers. So only genuine traffic makes it to your main hosting server. An added benefit is that the speed of the site is given a boost.

Hide Your WordPress Login

When you set up your WordPress website, one of the first things you should consider is hiding the login area. By default, the login area of your WordPress page is available with:

• /wp-login.php
• /login
• /wp-admin
• /admin

If a hacker knows that you have a WordPress site and if you have not hidden your login area, it is easy for the hacker to find your login page and start a brute force attack. There are a number of plug-ins that you can use to hide your login area. Some of the more popular ones include:

• (PLUGIN) WPS Hide Login - A great little lightweight plugin that lets you change your login URL to anything you want.
• iThemes Security (Better WP Security) - Although it comes with a lot of different features iThemes is a great way to protect your WP login page. It also has 2FA for login, malware scanning and reCAPTCH functionality.

Implement Two-Factor Authentication

Two-factor authentication gives your website an additional layer of security. In addition to the credentials to sign in to your website, you also need to give a one-time password.

For more details, please see this tutorial: How to Set Up Two-Factor Authentication for WordPress.

Protect WordPress Admin Directory

The majority of brute force attacks on WordPress are designed to gain access to the admin area. Your WordPress admin directory can be password-protected on the level of the server. This blocks unauthorized individuals from accessing your WordPress admin area. To do this, use the following steps:

1. Login to the hosting control panel
2. Click “Directory Privacy,” which is found in the files section
3. Find the WP–admin file and select its name
4. cPanel will request that the folder be given a name along with a username and a password
5. Enter this information and click the save button to save your settings

Now, your WordPress site is password-protected. A new password will be requested the next time you visit.

Disable Directory Browsing

If the index file cannot be found, it will show an index page containing the directory. In a brute force attack, a hacker can review the directory to try to find weak or vulnerable files. To change this, you need to put “Options -Indexes” at the end of your WordPress .htaccess file.

The above-mentioned tips should help you secure your WordPress site in the case of a brute-force attack. Have you been the victim of a brute force attack? What steps are you taking to secure your site? Let us know in the comments section below.