Quick answer
Stop WordPress brute-force attacks by limiting login attempts, enabling two-factor authentication, using strong unique passwords, and blocking malicious traffic with a firewall or Cloudflare rate-limiting rule before it reaches wp-login.php. Together these make guessing credentials impractical.
Key takeaways
- Brute-force bots run constantly — this isn't a matter of if, but when.
- Rate-limiting and login-attempt caps defeat automated guessing.
- Two-factor authentication makes a correct password guess useless on its own.
Brute-force attacks are the background noise of running a WordPress site. Bots try to guess your login credentials thousands of times a day. Left unchecked, they waste resources and occasionally get lucky. Here's how to shut them down.
Cap login attempts
Limit the number of failed logins before an IP or account is temporarily locked. This alone defeats the core of a brute-force attack, which depends on unlimited guesses.
Rate-limit at the edge
A firewall or a Cloudflare rate-limiting rule can block repeated hits on wp-login.php before they ever reach your server, keeping the attack off your site entirely.
Add two-factor authentication
Even a correctly guessed password fails without the second factor. 2FA turns a successful brute-force into a dead end.
Use strong, unique passwords
Long, random passwords make guessing statistically hopeless. A password manager makes them practical to use.
Watch the logs
Monitor failed-login patterns so you can spot and block persistent attackers. Ongoing monitoring turns a reactive scramble into a quiet, handled routine.
Free security check
Worried your site is infected?
Get a free security assessment — I'll tell you if your WordPress site is compromised and exactly what it needs. No obligation.
Follow-up questions
People also ask
It's an automated attack that tries many username and password combinations against your login page, hoping to guess valid credentials.
Keep reading
How to Recover Your Google Rankings After a Hack
A hack can tank your search rankings. Here's how to recover them once the site is clean.
WordPress Security for Small Businesses: A Practical Guide
You don't need an IT team to secure a small-business WordPress site. Here's a practical, no-jargon plan that covers the essentials.
How to Secure a WooCommerce Store
A WooCommerce store handles money and customer data, which makes it a target. Here's how to secure it without hurting sales.