Brute force
Definition
A brute-force attack tries many passwords or tokens until one works, usually against the login form.
Also called: brute-force, brute-force attack, bruteforce
Why it matters for WordPress
WordPress exposes a public login URL on most sites. Bots can hit wp-login.php and xmlrpc.php all day with guessed passwords. One weak Administrator password is enough for a full takeover.
How it shows up in practice
- Sudden spikes of failed logins from many IPs
- Lockouts or “too many attempts” messages for real users
- A successful login from an unfamiliar country right after a wave of failures
- XML-RPC multicall requests that try many passwords in one hit
What to do
- Use unique, long passwords (a password manager helps).
- Turn on two-factor authentication for admins and editors.
- Limit login attempts and block noisy IPs.
- Disable or tightly restrict XML-RPC if you do not need it.
- Watch the events log for new admin users and plugin installs after any suspected breach.
In WP Security Ninja
Pro login protection rate-limits failed attempts and supports lockouts so guessing gets expensive. Pair it with 2FA for privileged roles, and review the Events Logger when failure spikes are followed by a surprise success.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- Credential stuffing Credential stuffing replays usernames and passwords stolen from other breaches against your login.
- Two-factor authentication (2FA) Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
- Rate limiting Rate limiting caps how often an action can happen from an IP or account, which slows automated abuse.
- Login protection Login protection is the set of controls that harden the WordPress login against bots and credential attacks.
- Account takeover Account takeover is when an attacker gains control of a legitimate user account and can act as that user.
