What Is a Brute Force Attack?
Definition
A brute force attack is an attempt to break into an account by trying password after password, usually with automated tools, until one works. Against websites it often targets the login page directly. Variants use dictionaries of common passwords, leaked credentials, or guesses based on the site's name and content.
How It Works
OWASP describes brute force as an attacker "configuring predetermined values, making requests to a server using those values, and then analyzing the response." On WordPress, that means bots sending thousands of username and password pairs to wp-login.php or xmlrpc.php.
Modern campaigns are distributed. Instead of one machine hammering one site, a botnet of compromised servers and home devices spreads the guesses across many IP addresses, so simple blocking by address catches little. Attackers start with usernames they can learn from the site itself, such as author archives, then work through common passwords and variations.
WordPress's own guidance calls brute force "the simplest way to break in" and recommends layered defenses:
- Strong, unique passwords for every account with publishing or admin rights.
- Two-factor authentication, which "WordPress core does not include," so it comes from a plugin or identity provider.
- Rate limiting at the edge (a WAF or CDN) or web server, so repeated failures are throttled before they reach PHP.
- Protecting or disabling XML-RPC if nothing uses it.
- Monitoring and alerting on login anomalies.
Hiding the login URL "can reduce noise but should not be your only defense."
Real-World Example
On December 18, 2017, Wordfence reported what it called its most aggressive brute force campaign to date against WordPress sites. As reported by BleepingComputer, the attacks peaked at 14.1 million requests per hour from over 10,000 unique IP addresses and targeted around 190,000 sites per hour. Wordfence said the attackers used "a combination of common password lists and heuristics based on the domain name and contents of the site." Compromised sites were used to mine the cryptocurrency Monero or to attack other WordPress sites.
Why It Matters for a Small Business
Every public WordPress login is under constant automated guessing, whether or not the business is a target. One weak admin password is enough: the attacker gets full control of the site, can add a rogue admin user, plant malware, or use the server to attack others. Hosting resources also suffer, because thousands of login attempts consume PHP and database capacity and can slow the site for real visitors. The fixes are cheap compared with a cleanup. Login attacks also fill logs with noise, which makes the real warning signs harder to spot.
How to Spot It / How DTS Handles It
Warning signs: spikes of failed logins in security plugin or server logs, heavy traffic to wp-login.php or xmlrpc.php, account lockout emails, a sluggish site during odd hours, and admin accounts named "admin."
DTS enforces strong passwords and two-factor login for privileged WordPress users, removes unused accounts, and watches login logs. DTS can also help with rate limiting login and XML-RPC requests at a WAF or CDN. See our WordPress maintenance service, or hacked WordPress help if a login was already guessed.
Related Terms
- XML-RPC: an endpoint that lets attackers test many passwords per request.
- Credential stuffing: replaying leaked passwords instead of guessing.
- Password spraying: a few common passwords against many accounts.
- Web application firewall (WAF): where rate limiting usually lives.
- Rate limiting: throttling repeated login attempts.
- User enumeration: how attackers learn usernames first.
- Rogue admin user: a common result of a successful guess.
- Multi-factor authentication (MFA): the control that blunts guessed passwords.
Sources
- OWASP, Brute Force Attack: https://owasp.org/www-community/attacks/Brute_force_attack
- WordPress.org, Brute Force Attacks (Advanced Administration Handbook): https://developer.wordpress.org/advanced-administration/security/brute-force/
- BleepingComputer, Massive Brute-Force Attack Infects WordPress Sites with Monero Miners (December 20, 2017; reporting Wordfence research): https://www.bleepingcomputer.com/news/security/massive-brute-force-attack-infects-wordpress-sites-with-monero-miners/
Last updated October 14, 2026.