Security
Preventing brute force attacks on WordPress
3 May 2025 · 6 min read
Brute force attacks try to guess passwords by systematically trying all possible combinations. Every day millions of brute force attempts are registered on WordPress websites worldwide. Without protection your website can be cracked within hours.
At WP Maintainer we block thousands of brute force attempts daily. Our multi-layer security ensures attackers do not stand a chance. In this article we share the best methods to prevent these attacks.
How do brute force attacks work?
A brute force attack uses automated software to: 1. Find out usernames (often "admin" or the author name) 2. Try thousands of password combinations per minute 3. Use exploits via wp-login.php, xmlrpc.php or the REST API 4. Use botnets to attack from thousands of IP addresses
Method 1: Limit login attempts
The most effective basic measure is limiting login attempts. After 3-5 failed attempts the IP address is temporarily blocked. Use a plugin such as Limit Login Attempts Reloaded or the built-in function in Wordfence.
Method 2: Two-factor authentication (2FA)
With 2FA a password alone is not enough. The user must also enter a code sent to an app or phone. Even if a hacker knows your password, they cannot log in without the second factor.
Method 3: Change the login URL
The standard WordPress login page (/wp-admin or /wp-login.php) is known to everyone. Changing it to a unique URL makes it harder for attackers. Use WPS Hide Login or iThemes Security for this.
Method 4: Use strong passwords
One strong user with a strong password is better than ten users with weak passwords. Enforce strong passwords and require regular changes. Use a password manager for unique, complex passwords.
Method 5: Deactivate XML-RPC
XML-RPC is an old WordPress feature that is often abused for brute force attacks. If you do not use the Jetpack plugin or mobile apps, deactivate XML-RPC completely.
Professional protection
At WP Maintainer we implement all these measures and more as standard. Our security monitoring detects and blocks attacks in real time. With 24/7 availability and proactive alerts on suspicious activity you are always protected.