Brute force attacks are simple but relentless. A bot tries one password after another until something works. Every public login page receives these attempts, from WordPress to SSH. The good news is that a few layers of defence stop them almost completely.
How the attacks work
Attackers use lists of common and leaked passwords. They spread attempts across many IP addresses to avoid simple blocks. Some target one account with many passwords. Others try one common password on thousands of accounts. Both are cheap for criminals to run.
Layers of defence
- Use long, unique passwords stored in a password manager.
- Turn on two-factor authentication for every admin account.
- Limit login attempts and add short delays after failures.
- Block repeat offenders automatically with tools like fail2ban.
- Rename default admin usernames such as "admin".
- Restrict admin pages to known IP addresses when possible.
- Use SSH keys instead of passwords on servers.
Stopping brute force attacks at the server
Blocking bad traffic before it reaches your application saves resources. Server firewalls and web application firewalls drop known attackers early. That keeps your site fast even during an attack. On shared hosting, much of this protection is already in place.
Watch the signs
A sudden rise in failed logins is a warning. So is high CPU usage on the login page. Check your security logs weekly. If you see thousands of attempts, tighten your rules and confirm that 2FA is active.
Do not lock out real users
Balance matters. Too strict a limit can block real customers who mistype a password. Use short lockouts that grow with each failure. Offer a password reset by e-mail, and explain the rules on the login page.
Our website security service adds a firewall and login protection for your sites. For servers, follow our VPS hardening checklist and keep DDoS protection in mind for public services. With these layers, the attacks become noise in a log file instead of a crisis.
