Imagine waking up to find your WordPress website compromised, your data stolen, and your server overwhelmed. This nightmare often stems from a brute force attack, where hackers use automated scripts to guess usernames and passwords until they gain access.
These attacks threaten your site’s security and slow its performance due to the sheer volume of login attempts. Even if you’ve managed to secure your data, server overload can impact the user experience, and potentially damage your business reputation. Attacks are also on the rise, with 2022’s monthly average of 40 million rising to 200 million in early 2023.
While brute force attacks can target any platform, WordPress sites are vulnerable due to the vast number of people using them. In this article, we’ll provide actionable steps to safeguard your site from these attacks, ensuring your data and performance remain unaffected.
Methods of blocking WordPress brute force attacks
The philosophy behind a brute force attack is similar to that behind breaking and entering a property. If one window is locked, a hacker will look for another way in. Thankfully, there are several methods to block such attacks, and adopting these will cover all potential avenues.
Use strong passwords
Brute force attacks exploit the simplicity of guessing usernames and passwords to gain unauthorized access to your WordPress site. By using stronger, more complex passwords, you increase the difficulty for attackers to guess your credentials.
Follow our tips for choosing a secure password:
- Avoid personal information: Never use a version of your own name, username, company name, or website name. These are often the first guesses in a brute force attack.
- Avoid full words: Do not use full words in any language, as these can be discovered using dictionary list attacks.
- Length matters: Short passwords are easier to crack. Aim for passwords that are at least 12 characters long.
- Make them complex: Always use a combination of uppercase and lowercase letters, numbers, and special characters. Complexity makes it much harder for attackers to guess your password.
- Make them unique: Ensure each of your accounts or websites has its own password. This prevents a breach in one account from compromising others.
Tools like Solid Security make it easy to enforce the use of strong passwords on your WordPress site. With just a few clicks, you can:
- Force strong passwords: Site owners can apply strong password rules to specific sets of users, removing any password weak-links.
- Set password expiry dates: A maximum number of days can be set before a password expires and must be changed. This reduces the risk of long-term exposure.
- Prevent reused passwords: Users can be blocked from adopting passwords that have appeared in data breaches tracked by Have I Been Pwned, ensuring compromised passwords are not reused.
For detailed instructions on setting up these features, refer to our in-depth guide to password requirements.
Enable two-factor authentication (2FA)
Single-step authentication relies solely on a password to access your WordPress site, making it vulnerable to brute force attacks. Hackers often use automated bots to guess passwords until they gain access.
Two-factor authentication (2FA) significantly increases security by requiring two forms of verification:
- Something you know, e.g., your password.
- Something you have, e.g., a code from your phone or another device.
This additional layer makes it much harder for attackers to succeed, as they would need both your password and access to your secondary device.
Implementing 2FA on your WordPress site is straightforward with a plugin like Solid Security. You can enforce 2FA for all users or specific roles, reducing the risk of unauthorized access. Solid Security also supports various 2FA methods, including authenticator apps like Google Authenticator and Authy, ensuring flexibility for all users.
While using a strong password combined with 2FA is an effective way to thwart brute force attacks, moving beyond passwords to more secure methods like passkeys offers even greater protection. Passkeys use public and private key pairs for authentication, removing the need for passwords altogether. You can find more information on this in our comprehensive guide to passkeys.
Update your WordPress username
In older versions of WordPress, the default username was set to ‘admin’. This common username makes brute force attacks easier, as attackers can focus solely on guessing the password. If your site still uses ‘admin’ as its username, it’s highly recommended to update it as soon as possible.
Unfortunately, you can’t change the username directly from the WordPress dashboard. The easiest method is to create a new user and delete the old admin account. Here’s how to do this:
- Go to Users > Add New User.
- Create a new username and enter your email address. Set the role to Administrator.
- Log out and log back in, using your new account.
- Go to All Users and click Delete under the original admin account.
- Move all content to your new account by selecting Attribute all content to (new username).
- Click Confirm Deletion.
Limit login attempts
By default, WordPress does not include a feature to limit the number of login attempts a user can make. Limiting login attempts is an effective way to mitigate brute force attacks by reducing the number of guesses an attacker can make.
The easiest way to implement this security measure is by using a dedicated plugin. Solid Security lets you set a threshold for the number of login attempts a user can make before being locked out. For example, if a user fails to log in five times, they will be temporarily banned from accessing your site. This significantly reduces the chances of a successful brute force attack.
- Go to Security > Settings > Features.
- Click on Firewall, then scroll down to Local Brute Force.
- Click on the drop-down arrow, and you’ll be able to access the screen seen below.
- Remember to click Save once you’ve amended the number of allowed login attempts.
Moreover, Solid Security leverages a brute force protection network that spans over 1 million websites. This network automatically bans Internet Protocol (IP) addresses that have attempted to break into any site within the community. By using this feature, you can preemptively block malicious IPs known for brute force attacks, improving your site’s security even further.
Download our free guide to brute force attacks for more information.
Enhancing WordPress security with Solid Security
The above steps are must-have support measures for all WordPress sites, and adding the Solid Security plugin makes them easy to achieve. With the tool as part of your security arsenal, you’ll gain access to a range of features designed to protect your site:
- Dedicated brute force protection: Solid Security allows you to curate your own list of bad users and automatically blacklist those identified by its Brute Force Protection Network, which spans over a million websites. This network helps preemptively block IP addresses known for malicious activities.
- Enhanced login security: Our platform makes it easy to enforce strong passwords and 2FA, limit login attempts, and enable passkeys for ultra-secure authentication.
- Identify website vulnerabilities: Automatic scans look for vulnerabilities in WordPress core, theme, and plugin updates. Solid Security Pro also integrates with Patchstack to patch any vulnerabilities found.
“If you are in that situation where you have other things you have to focus on, and security can’t be something that you pay huge amounts of attention to, you need a basic foundation for your security and Patchstack provides a fantastic catch-all for so many of the vulnerabilities that worry people.”
David G Johnson, Product Owner, SolidWP
Solid Security is easy to set up and can help secure your WordPress site in a matter of minutes. A free version is available to get you started, and you can upgrade to the pro version to access the full feature set.
Secure your WordPress site with Solid Security today
Protecting your WordPress site against brute force attacks is crucial for maintaining its security and performance. With the average global cost of a data breach now costing a company $4.45 million, few brands can afford to skimp on their security.
While steps like strong passwords and 2FA are essential, the most effective solution can be found in a powerful plugin like Solid Security. With features including dedicated brute force protection, comprehensive login security, and automated vulnerability scans, Solid Security is the perfect partner in safeguarding your website. Once activated, site owners are freed up to focus on business matters, safe in the knowledge their security is being managed in the background.
Don’t leave your site vulnerable — get started with Solid Security today and fortify your online presence!