A brute force attack on WordPress is a systematic attempt to guess your admin username and password by trying thousands of combinations automatically. WordPress sites are targeted constantly — the /wp-admin and /wp-login.php URLs are publicly known and bots probe them around the clock. The good news: brute force attacks are entirely preventable with a few specific measures.
How to detect a brute force attack in progress
Install Wordfence Security (free) if you have not already. Under Wordfence → Tools → Live Traffic, you can see login attempts in real time. Under Wordfence → Scan → Results, you will see a summary of recent failed login activity. Your hosting control panel may also show CPU or bandwidth spikes at unusual times — these often correspond to login attack waves.
WordPress security services →Protection 1: Rate limit login attempts
Enable login attempt throttling so that after a set number of failed attempts, the IP address is temporarily blocked. In Wordfence, go to Wordfence → Firewall → All Firewall Options → Brute Force Protection. Set Failed Login Attempts Before Lockout to 5 and Lockout Duration to 60 minutes. This breaks automated bots that rely on rapid repeated attempts.
Protection 2: Enable two-factor authentication
Two-factor authentication makes stolen passwords useless — the attacker also needs access to your authenticator app or email to log in. Enable it via Wordfence → Login Security → Two-Factor Authentication or install the WP 2FA plugin. Require it for all administrator and editor accounts. This is the single most effective measure against account takeover.
Protection 3: Move or block the default login URL
The vast majority of WordPress brute force bots target /wp-admin and /wp-login.php. Use WPS Hide Login to change your login URL to a custom path known only to you. Add this to your .htaccess to return a 404 on the original login paths — this stops bots that have already discovered your domain from even attempting to reach the login form.
Protection 4: Block IPs via Cloudflare
If you are under an active attack from specific IP addresses or countries, use Cloudflare to block them before the traffic even reaches your server. Create a WAF (Web Application Firewall) rule in Cloudflare to block requests targeting /wp-login.php from non-whitelisted IPs or countries. This stops the attack at the CDN edge — protecting both your site and your server resources.
Protection 5: Use strong, unique credentials
Ensure your admin username is not "admin" — this is the most commonly targeted username in brute force attacks. Use a randomly generated password of at least 20 characters. Use a password manager (1Password, Bitwarden) to store it. Never reuse passwords across sites. These measures make successful brute force attacks computationally impractical even if rate limiting is bypassed.
ImportantIf you are on shared hosting and under a heavy brute force attack, the resource consumption from the attack itself — even with login protection blocking attempts — can slow your site for legitimate visitors. Cloudflare's free plan blocks attack traffic before it reaches your server and is worth setting up regardless of whether you are under active attack. It also provides a significant performance benefit.