---
title: Brute force
canonical: https://wpsecurityninja.com/dictionary/brute-force/
---
# Brute force

A brute-force attack tries many passwords or tokens until one works, usually against the login form.

[Full guide](https://wpsecurityninja.com/wordpress-login-security-complete-guide/)

## FAQ

### Is brute force the same as credential stuffing?

No. Brute force guesses many passwords for an account (or tries common passwords across accounts). Credential stuffing replays username and password pairs stolen from other breaches. Both hit wp-login.php, and both are slowed by rate limits and 2FA.

### Can renaming the login URL stop brute force?

It may cut casual bot noise for a while. Determined scanners still find wp-login.php, XML-RPC, or the REST API. Treat rename as optional garnish. Strong passwords, rate limits, and 2FA do the real work.

## Why it matters for WordPress

WordPress exposes a public login URL on most sites. Bots can hit `wp-login.php` and `xmlrpc.php` all day with guessed passwords. One weak Administrator password is enough for a full takeover.

## How it shows up in practice

- Sudden spikes of failed logins from many IPs
- Lockouts or “too many attempts” messages for real users
- A successful login from an unfamiliar country right after a wave of failures
- XML-RPC multicall requests that try many passwords in one hit

## What to do

1. Use unique, long passwords (a password manager helps).
2. Turn on two-factor authentication for admins and editors.
3. Limit login attempts and block noisy IPs.
4. Disable or tightly restrict XML-RPC if you do not need it.
5. Watch the events log for new admin users and plugin installs after any suspected breach.

## In WP Security Ninja

Pro [login protection](https://wpsecurityninja.com/login-protection/) rate-limits failed attempts and supports lockouts so guessing gets expensive. Pair it with [2FA](https://wpsecurityninja.com/two-factor-authentication-2fa/) for privileged roles, and review the [Events Logger](https://wpsecurityninja.com/events-logger/) when failure spikes are followed by a surprise success.