{"id":581,"date":"2026-05-23T10:19:10","date_gmt":"2026-06-29T11:07:58","guid":{"rendered":"https:\/\/brutefort.com\/blog\/brute-force-attack-wordpress\/"},"modified":"2026-09-03T09:03:50","modified_gmt":"2026-09-03T09:03:50","slug":"brute-force-attack-wordpress","status":"publish","type":"post","link":"https:\/\/brutefort.com\/blog\/brute-force-attack-wordpress\/","title":{"rendered":"What Is a Brute Force Attack on WordPress (And How to Stop One)"},"content":{"rendered":"\n
\"Code
Photo by Markus Spiske from Pexels<\/figcaption><\/figure>\n\n\n\n

A brute force attack is exactly what it sounds like: an attacker \u2014 almost always a bot \u2014 tries to log in to your WordPress site by guessing passwords. Not creatively. Not cleverly. Just over and over, thousands of times, until something works.<\/p>\n\n\n\n

Picture someone trying every key on a giant keychain against your front door, one after another, without pausing. That’s a brute force attack, except the “door” is your WordPress login page and the “keys” are millions of leaked passwords.<\/p>\n\n\n\n

Quick Answer:<\/strong> A brute force attack is an automated, repeated password-guessing attack against your login page. WordPress has zero built-in protection against it. Rate limiting and a custom login URL \u2014 both included in BruteFort \u2014 stop it completely.<\/p><\/div>\n\n\n\n

It’s one of the oldest attack methods on the internet, and it’s still one of the most common on WordPress specifically. Why? Because every WordPress site’s login page sits at the same predictable URL by default. No reconnaissance needed \u2014 the bot already knows where to look.<\/p>\n\n\n\n

How a Brute Force Attack Actually Works<\/h2>\n\n\n\n

The attack itself is simple. A bot sends POST requests to \/wp-login.php<\/code> with a username and password. WordPress checks the credentials, returns a failure, and the bot tries the next combination. Repeat, at hundreds or thousands of attempts per minute.<\/p>\n\n\n\n

Most bots start with the username admin<\/strong> \u2014 the WordPress default that a huge percentage of older sites still use. From there, they cycle through password lists that range from common choices like “password123” to massive databases of passwords from previous data breaches.<\/p>\n\n\n\n

Here’s the thing: WordPress doesn’t slow them down. There’s no built-in limit on how many times someone can attempt a login. No lockout after failed attempts. No alert that anything unusual is happening. The bot can run indefinitely without any friction unless you add it yourself.<\/p>\n\n\n\n

The Real Cost of a Successful Attack<\/h2>\n\n\n\n

If the attack succeeds and an attacker gets admin access to your WordPress site, the consequences are serious. They can install malware, redirect your traffic, steal customer data, add your site to a spam network, or simply destroy content.<\/p>\n\n\n\n

Cleanup is expensive and time-consuming \u2014 and some hosting providers will take your site offline entirely if they detect malicious activity coming from it. Even a failed attack has a cost. Thousands of login requests put load on your server, and shared hosting plans are particularly vulnerable to slowdowns from attack traffic.<\/p>\n\n\n\n

What Stops a Brute Force Attack<\/h2>\n\n\n\n

Two things make brute force attacks impractical: limiting attempts and hiding the target.<\/p>\n\n\n\n

BruteFort covers both from a single plugin; here’s how each piece works.<\/p>\n\n\n\n

\n