---
title: Brute force
canonical: https://wpsecurityninja.com/dictionary/brute-force/
---
# Brute force

A brute-force attack tries many passwords or tokens until one works, usually against the login form.

Last updated: 2026-08-26

Also called: brute-force, brute-force attack, bruteforce

## Related terms

- [Credential stuffing](https://wpsecurityninja.com/dictionary/credential-stuffing/): Credential stuffing replays usernames and passwords stolen from other breaches against your login.
- [Two-factor authentication (2FA)](https://wpsecurityninja.com/dictionary/two-factor-authentication/): Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
- [Rate limiting](https://wpsecurityninja.com/dictionary/rate-limiting/): Rate limiting caps how often an action can happen from an IP or account, which slows automated abuse.
- [Login protection](https://wpsecurityninja.com/dictionary/login-protection/): Login protection is the set of controls that harden the WordPress login against bots and credential attacks.
- [Account takeover](https://wpsecurityninja.com/dictionary/account-takeover/): Account takeover is when an attacker gains control of a legitimate user account and can act as that user.

[Full guide](https://wpsecurityninja.com/wordpress-login-security-complete-guide/)

## FAQ

### Is brute force the same as credential stuffing?

No. Brute force guesses many passwords for an account (or tries common passwords across accounts). Credential stuffing replays username and password pairs stolen from other breaches. Both hit wp-login.php, and both are slowed by rate limits and 2FA.

### Can renaming the login URL stop brute force?

It may cut casual bot noise for a while. Determined scanners still find wp-login.php, XML-RPC, or the REST API. Treat rename as optional garnish. Strong passwords, rate limits, and 2FA do the real work.

## Why it matters for WordPress

WordPress exposes a public login URL on most sites. Bots can hit `wp-login.php` and `xmlrpc.php` all day with guessed passwords. One weak Administrator password is enough for a full takeover.

## How it shows up in practice

- Sudden spikes of failed logins from many IPs
- Lockouts or “too many attempts” messages for real users
- A successful login from an unfamiliar country right after a wave of failures
- XML-RPC multicall requests that try many passwords in one hit

## What to do

1. Use unique, long passwords (a password manager helps).
2. Turn on two-factor authentication for admins and editors.
3. Limit login attempts and block noisy IPs.
4. Disable or tightly restrict XML-RPC if you do not need it.
5. Watch the events log for new admin users and plugin installs after any suspected breach.

## In WP Security Ninja

Pro [login protection](https://wpsecurityninja.com/login-protection/) rate-limits failed attempts and supports lockouts so guessing gets expensive. Pair it with [2FA](https://wpsecurityninja.com/two-factor-authentication-2fa/) for privileged roles, and review the [Events Logger](https://wpsecurityninja.com/events-logger/) when failure spikes are followed by a surprise success.