What Is a Brute Force Attack? Is Your Site Vulnerable to One?

Your login page is the most vulnerable part of your website. It is the perfect target for a brute force attack — the most common form of online hacking.

What is a Brute Force Attack?

A brute force attack is the most rudimentary form of hacking: it employs bots that try different combinations of usernames and passwords until they find the right one. These are called malicious login attempts and can affect your website’s performance.

Each time a visitor lands on your website, their IP address makes an HTTP request to your website’s server. When bots are constantly visiting your login page in an attempt to crack your password, the number of HTTP requests spikes. All this website traffic will slow down your site, or worse, cause your server to run out of memory.

Secure Login Credentials

Choosing strong login credentials is the first step to better web security — on any site. Change your username from “admin” to something unique. “Admin” might be simple to remember, but it’s also easy to hack. Avoid using passwords that contain a version of your own name or a word in the dictionary. Choose a passphrase with a mix of numbers and letters or use a password manager that will generate secure passwords and save them for you.

If you have Jetpack installed on your site, you can enable Secure Sign On and use the same credentials you use for WordPress.com to sign in to self-hosted WordPress.org sites quickly and securely. You can choose to make this the only way to log in and disable the default login form completely.

Jetpack Brute Force Attack Protection

It’s not just your blog content at risk during a brute force attack. If a hacker successfully accesses your administrator account, your entire server could be compromised. That’s why every Jetpack plan includes protection from brute force attacks, including distributed attacks that use many servers against your site.

When an IP registers too many failed login attempts, Jetpack will block that IP from accessing the login form, quickly limiting HTTP requests before they slow down your site. Your site will be protected, and you can see the number of attacks that Jetpack has stopped with a widget in your self-hosted site’s dashboard.

Next Steps: Compare plans and choose the right one for your site.

Andrea Zoellner

Copywriter, entrepreneur, and recovering nomophobe. I'm obsessed with French expressions, English puns, and packing the perfect carry-on.