Do you want to protect your WordPress site from brute force attacks?
A brute force attack can slow down your website, make it inaccessible, and even crack your passwords to install malware on your website.
In this article, we will show you how to protect your WordPress site from brute force attacks.
What is a Brute Force Attack?
Brute Force Attack is a hacking method that uses trial and error to break into a website, a network, or a computer system.
The most common type of brute force attack is password guessing. Hackers use automated software to keeping guessing your login information so they can gain access to your website.
These automated hacking tools can also disguise themselves by using different IP addresses and locations, which makes it harder to identify and block their suspicious activities.
A successful brute force attack can give hackers access to your website’s admin area. They can install malware, steal user information, and delete everything on your site.
Even unsuccessful brute force attacks can wreak havoc by sending too many requests to your WordPress hosting servers, slowing down or even completely crashing your website.
That being said, let’s take a look at how to protect your WordPress site from brute force attacks.
1. Install a WordPress Firewall Plugin
Brute force attacks put a lot of load on your servers. Even the unsuccessful ones can slow down your website or completely crash the server. This is why it’s important to block them before they get to your server.
To do that, you’ll need a website firewall solution. A firewall filters out bad traffic and blocks it from accessing your site.
There are two types of website firewalls that you can use.
Application Level Firewall – These firewall plugins examine the traffic once it reaches your server but before loading most WordPress scripts. This method is not as efficient because a brute force attack can still affect your server load.
DNS Level Website Firewall – These firewalls route your website traffic through their cloud proxy servers. This allows them to only send genuine traffic to your main web hosting server while giving a boost to your WordPress speed and performance.
We recommend using Sucuri. It is the industry leader in website security and the best WordPress firewall in the market. Since it’s a DNS level website firewall, it means all your website traffic goes through their proxy where bad traffic is filtered out.
2. Install WordPress Updates
Some common brute force attacks actively target known vulnerabilities in older versions of WordPress, popular WordPress plugins, or themes.
WordPress core and most popular WordPress plugins are open source, and vulnerabilities are often fixed very quickly with an update. However, if you fail to install updates, then you leave your website vulnerable to those old threats.
Simply go to Dashboard » Updates page in WordPress admin area to check for available updates. This page will show all updates for your WordPress core, plugins, and themes.
For more details, see our guides on how to safely update WordPress and properly update WordPress plugins.
3. Protect WordPress Admin Directory
Most brute force attacks on a WordPress site are trying to get access to the WordPress admin area. You can add password protection on your WordPress admin directory on a server level. This would block unauthorized access to your WordPress admin area.
Simply login to your WordPress hosting control panel (cPanel) and click on the ‘Directory Privacy’ icon under Files section.
Next, you need to locate the wp-admin folder and click on the folder name.
cPanel will now ask you to provide a name for the restricted folder, username, and password. After entering this information click on the save button to store your settings.
Your WordPress admin directory is now password protected. You will see a new login prompt when you visit your WordPress admin area.
If you run into a 404 error or error too many redirects message, then you need to add the following line to your WordPress .htaccess file.
For more details, see our article on how to password protect WordPress admin directory.
4. Add Two-Factor Authentication in WordPress
Two-Factor authentication adds an additional security layer to your WordPress login screen. Users will need their phones to generate a one-time passcode along with their login credentials to access the WordPress admin area.
Adding two-factor authentication will make it harder for hackers to gain access even if they are able to crack your WordPress password.
For detailed step by step instructions, see our guide on how to how to add two-factor authentication in WordPress
5. Use Unique and Strong Passwords
Passwords are the keys to gaining access to your WordPress site or eCommerce store. You need to use unique strong passwords for all your accounts. A strong password is a combination of numbers, letters, and special characters.
It’s important that you use strong passwords for not just your WordPress user accounts but also for FTP client, web hosting control panel, and your WordPress database.
Most beginners ask us how to remember all these unique passwords? Well, you don’t need to. There are excellent password manager apps available that will securely store your passwords and automatically fill them in for you.
To learn more, see our beginner’s guide on best ways to manage passwords for WordPress.
6. Disable Directory Browsing
By default, when your web server does not find an index file (i.e. a file like index.php or index.html), it automatically displays an index page showing the contents of the directory.
During a brute force attack, hackers can use directory browsing to look for vulnerable files. To fix this, you need to add the following line at the bottom of your WordPress .htaccess file using an FTP service.
7. Disable PHP File Execution in Specific WordPress Folders
Hackers may want to install and execute a PHP script in your WordPress folders. WordPress is written mainly in PHP, which means you cannot disable that in all WordPress folders.
However, there are some folders that don’t need any PHP scripts. For example, your WordPress uploads folder located at /wp-content/uploads.
You can safely disable PHP execution in the uploads folder which is a common place hackers use to hide backdoor files.
First, you need to open a text editor like Notepad on your computer and paste the following code:
Now, save this file as .htaccess and upload it to /wp-content/uploads/ folders on your website using an FTP client.
8. Install and Setup a WordPress Backup Plugin
Backups are the most important tool in your WordPress security arsenal. If all else fails, then backups will allow you to easily restore your website.
Most WordPress hosting companies offer limited backup options. However, these backups are not guaranteed, and you are solely responsible for making your own backups.
There are several great WordPress backup plugins, which allow you to schedule automatic backups.
We recommend using UpdraftPlus. It is beginner friendly and allows you to quickly setup automatic backups and store them on remote locations like Google Drive, Dropbox, Amazon S3, and more.