Attacks Dictionary
Brute force
Definition
A brute-force attack tries many passwords or tokens until one works, usually against the login form.
Also called: brute-force, brute-force attack, bruteforce
Why it matters for WordPress
WordPress exposes a public login URL on most sites. Bots can hit wp-login.php and xmlrpc.php all day with stolen or guessed passwords. One weak admin password is enough.
How it shows up in practice
- Sudden spikes of failed logins from many IPs
- Lockouts or “too many attempts” messages for real users
- Successful login from an unfamiliar country right after a wave of failures
- Abuse of XML-RPC multicall to try many passwords in one request
What to do
- Use unique, long passwords (a password manager helps).
- Turn on two-factor authentication for admins and editors.
- Limit login attempts and block noisy IPs.
- Disable or tightly restrict XML-RPC if you do not need it.
- Watch the events log for new admin users and plugin installs after any suspected breach.
Product tip: login rate limits and related controls live under login protection.
Related terms
Nearby ideas in the dictionary
- Credential stuffing Credential stuffing replays usernames and passwords stolen from other breaches against your login.
- Two-factor authentication (2FA) Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
- Rate limiting Rate limiting caps how often an action can happen from an IP or account, which slows automated abuse.
- Login protection Login protection is the set of controls that harden the WordPress login against bots and credential attacks.