<\/span><\/h1>\n\n\n\nWordPress websites are frequently exposed to automated login attempts. A brute-force attack occurs when an attacker repeatedly tries different usernames and passwords in an attempt to gain access to a WordPress account.<\/p>\n\n\n\n
These attacks do not always mean that someone is specifically targeting your website. Automated bots can scan large numbers of websites and continuously test publicly accessible login endpoints.<\/p>\n\n\n\n
The good news is that WordPress brute-force attacks can be significantly reduced by combining strong authentication, login rate limiting, two-factor authentication, firewall protection, secure hosting, monitoring, and regular maintenance<\/strong>.<\/p>\n\n\n\nThis guide explains how brute-force attacks work and provides practical ways to protect a WordPress website.<\/p>\n\n\n\n
\n\n\n\n<\/span>What Is a WordPress Brute-Force Attack?<\/span><\/h2>\n\n\n\nA brute-force attack is an automated attempt to gain access to an account by repeatedly trying different credentials.<\/p>\n\n\n\n
A basic attack may look like:<\/p>\n\n\n\n
admin \/ password\nadmin \/ 123456\nadmin \/ admin123\nadmin \/ password123\n...<\/code><\/pre>\n\n\n\nMore advanced attacks may use lists of previously leaked usernames and passwords.<\/p>\n\n\n\n
The goal is usually to discover a valid combination:<\/p>\n\n\n\n
Username + Password\n \u2193\nSuccessful Login\n \u2193\nUnauthorized Access<\/code><\/pre>\n\n\n\nOnce an attacker obtains an administrator account, they may be able to change website settings, install malicious software, modify content, or access sensitive information.<\/p>\n\n\n\n
\n\n\n\n<\/span>Why WordPress Is Targeted by Brute-Force Bots<\/span><\/h1>\n\n\n\nWordPress has predictable login endpoints, including:<\/p>\n\n\n\n
\/wp-login.php<\/code><\/pre>\n\n\n\nand the administration area:<\/p>\n\n\n\n
\/wp-admin\/<\/code><\/pre>\n\n\n\nBecause these paths are common across WordPress websites, automated systems can easily identify and test them.<\/p>\n\n\n\n
Attackers may also use:<\/p>\n\n\n\n