WPBeginner

Beginner's Guide for WordPress

  • Blog
    • Beginners Guide
    • News
    • Opinion
    • Showcase
    • Themes
    • Tutorials
    • WordPress Plugins
  • Start Here
    • How to Start a Blog
    • Create a Website
    • Start an Online Store
    • Best Website Builder
    • Email Marketing
    • WordPress Hosting
    • Business Name Ideas
  • Deals
    • Bluehost Coupon
    • SiteGround Coupon
    • WP Engine Coupon
    • HostGator Coupon
    • Domain.com Coupon
    • Constant Contact
    • View All Deals »
  • Glossary
  • Videos
  • Products
X
☰
Beginner's Guide for WordPress / Start your WordPress Blog in minutes
Choosing the Best
WordPress Hosting
How to Easily
Install WordPress
Recommended
WordPress Plugins
View all Guides

WPBeginner» Blog» Tutorials» How to Protect Your WordPress Site from Brute Force Attacks (Step by Step)

How to Protect Your WordPress Site from Brute Force Attacks (Step by Step)

Last updated on August 7th, 2018 by Editorial Staff
452 Shares
Share
Tweet
Share
Pin
Free WordPress Video Tutorials on YouTube by WPBeginner
How to Protect Your WordPress Site from Brute Force Attacks (Step by Step)

Do you want to protect your WordPress site from brute force attacks? These attacks can slow down your website, make it inaccessible, and even crack your passwords to install malware on your website. In this article, we will show you how to protect your WordPress site from brute force attacks.

protecting WordPress from brute force attacks

What is a Brute Force Attack?

Brute Force Attack is a hacking method which utilizes trial and error techniques to break into a website, a network or a computer system.

Hackers use automated software to send a large number of requests to the target system. With each request, these software attempt to guess the information needed to gain access, like passwords or pin codes.

These tools can also disguise themselves by using different IP addresses and locations, which makes it harder for the targeted system to identify and block these suspicious activities.

A successful brute force attack can give hackers access to your website’s admin area. They can install backdoor, malware, steal user information, and delete everything on your site.

Even unsuccessful brute force attacks can wreak havoc by sending too many requests which slows down your WordPress hosting servers and even crash them.

That being said, let’s take a look at how to protect your WordPress site from brute force attacks.

Step 1. Install a WordPress Firewall Plugin

Brute force attacks put a lot of load on your servers. Even the unsuccessful ones can slow down your website or completely crash the server. This is why it’s important to block them before they get to your server.

To do that, you’ll need a website firewall solution. A firewall filters out bad traffic and blocks it from accessing your site.

How website firewall works

There are two types of website firewalls that you can use.

Application Level Firewall – These firewall plugins examine the traffic once it reaches your server but before loading most WordPress scripts. This method is not as efficient because a brute force attack can still affect your server load.

DNS Level Website Firewall – These firewall route your website traffic through their cloud proxy servers. This allows them to only send genuine traffic to your main web hosting server while giving a boost to your WordPress speed and performance.

We recommend using Sucuri. It is the industry leader in website security and the best WordPress firewall in the market. Since it’s a DNS level website firewall, it means all your website traffic goes through their proxy where bad traffic is filtered out.

We use Sucuri on our website, and you can read our complete Sucuri review to learn more.

Step 2. Install WordPress Updates

Some common brute force attacks actively target known vulnerabilities in older versions of WordPress, popular WordPress plugins, or themes.

WordPress core and most popular WordPress plugins are open source and vulnerabilities are often fixed very quickly with an update. However if you fail to install updates, then you leave your website vulnerable to those old threats.

Simply go to Dashboard » Updates page in WordPress admin area to check for available updates. This page will show all updates for your WordPress core, plugins, and themes.

Updates page in WordPress admin area

For more details, see our guide on how to properly update WordPress plugins.

Step 3. Protect WordPress Admin Directory

Most brute force attacks on a WordPress site are trying to get access to the WordPress admin area. You can add password protection on your WordPress admin directory on a server level. This would block unauthorized access to your WordPress admin area.

Simply login to your WordPress hosting control panel (cPanel) and click on the ‘Directory Privacy’ icon under Files section.

Note: We’re using Bluehost in our screenshot but similar settings are available on other top hosting companies as well like SiteGround, HostGator, etc.

Directory privacy in cPanel

Next, you need to locate the wp-admin folder and click on the folder name.

Browse and locate the wp-admin folder

cPanel will now ask you to provide a name for the restricted folder, username, and password. After entering this information click on the save button to store your settings.

Password protect WordPress admin directory

Your WordPress admin directory is now password protected. You will see a new login prompt when you visit your WordPress admin area.

Login prompt

If you run into a 404 error or error too many redirects message, then you need to add the following line to your WordPress .htaccess file.

ErrorDocument 401 default

For more details, see our article on how to password protect WordPress admin directory.

Step 4. Add Two-Factor Authentication in WordPress

Two-Factor authentication adds an additional security layer to your WordPress login screen. Basically, users will need their phones to generate a one-time passcode along with their login credentials to access the WordPress admin area.

Enter two-step authentication code

Adding two-factor authentication will make it harder for hackers to gain access even if they are able to crack your WordPress password.

For detailed step by step instructions, see our guide on how to how to add two-factor authentication in WordPress

Step 5. Use Unique Strong Passwords

Passwords are the keys to gain access to your WordPress site. You need to use unique strong passwords for all your accounts. A strong password is a combination of numbers, letters, and special characters.

It’s important that you use strong passwords for not just your WordPress user accounts but also for FTP, web hosting control panel, and your WordPress database.

Most beginners ask us how to remember all these unique passwords? Well, you don’t need to. There are excellent password manager apps available that will securely store your passwords and automatically fill them in for you.

To learn more, see our beginner’s guide on best way to manage passwords for WordPress.

Step 6. Disable Directory Browsing

By default, when your web server does not find an index file (i.e. a file like index.php or index.html), it automatically displays an index page showing the contents of the directory.

Directory index

During a brute force attack, hackers can use directory browsing to look for vulnerable files. To fix this, you need to add the following line at the bottom of your WordPress .htaccess file.

Options -Indexes

For more details, see our article on how to disable directory browsing in WordPress.

Step 7. Disable PHP File Execution in Specific WordPress Folders

Hackers may want to install and execute a PHP script in your WordPress folders. WordPress is written mainly in PHP, which means you cannot disable that in all WordPress folders.

However, there are some folders that don’t need any PHP scripts. For example, your WordPress uploads folder located at /wp-content/uploads.

You can safely disable PHP execution in the uploads folder which is a common place hackers use to hide backdoor files.

First, you need to open a text editor like Notepad on your computer and paste the following code:

<Files *.php>
deny from all
</Files>

Now, save this file as .htaccess and upload it to /wp-content/uploads/ folders on your website using an FTP client.

Step 8. Install and Setup a WordPress Backup Plugin

WordPress backup plugins

Backups are the most important tool in your WordPress security arsenal. If all else fails, then backups will allow you to easily restore your website.

Most WordPress hosting companies offer limited backup options. However, these backups are not guaranteed, and you are solely responsible for making your own backups.

There are several great WordPress backup plugins, which allow you to schedule automatic backups.

We recommend using UpdraftPlus. It is beginner friendly and allows you to quickly setup automatic backups and store them on remote locations like Google Drive, Dropbox, Amazon S3, and more.

For step by step instructions, see our guide on how to how to backup and restore your WordPress site with UpdraftPlus

All above-mentioned tips will help you protect your WordPress site against brute force attacks. For a more comprehensive security setup, you should follow the instructions in our ultimate WordPress security guide for beginners.

We hope this article helped you learn how to protect your WordPress site from brute force attacks. You may also want to look out for the signs that your WordPress is hacked and how to fix a hacked WordPress site.

If you liked this article, then please subscribe to our YouTube Channel for WordPress video tutorials. You can also find us on Twitter and Facebook.

452 Shares
Share
Tweet
Share
Pin
Popular on WPBeginner Right Now!
  • Google Analytics in WordPress

    How to Install Google Analytics in WordPress for Beginners

  • Revealed: Why Building an Email List is so Important Today (6 Reasons)

    Revealed: Why Building an Email List is so Important Today (6 Reasons)

  • How to Fix the Error Establishing a Database Connection in WordPress

    How to Fix the Error Establishing a Database Connection in WordPress

  • Checklist

    Checklist: 15 Things You MUST DO Before Changing WordPress Themes

About the Editorial Staff

Editorial Staff at WPBeginner is a team of WordPress experts led by Syed Balkhi. Trusted by over 1.3 million readers worldwide.

The Ultimate WordPress Toolkit

5 Comments

Leave a Reply
  1. Renuga says:
    Jun 25, 2019 at 9:21 am

    HI,
    For step-3 admin protection, we need to show the login in WP-admin only but its showing in site also. So, please help us how to show only in WP-admin.

    Reply
    • WPBeginner Support says:
      Jun 26, 2019 at 10:49 am

      If you mean it is in your widget area you may want to check for a meta widget under Appearance>Widgets

      Reply
  2. Dreamandu says:
    Apr 29, 2019 at 9:57 pm

    I am under the brute force attack right now from different IPs. What can I do to protect my site right now?

    Reply
    • WPBeginner Support says:
      Apr 30, 2019 at 10:23 am

      You can use any of the methods in this article to start combating the brute force attack

      Reply
  3. Chidubem Ezenwa says:
    Aug 7, 2018 at 10:50 am

    Yet another helpful guide. Thanks guys.

    Reply

Leave a Reply Cancel reply

Thanks for choosing to leave a comment. Please keep in mind that all comments are moderated according to our comment policy, and your email address will NOT be published. Please Do NOT use keywords in the name field. Let's have a personal and meaningful conversation.

Over 1,320,000+ Readers

Get fresh content from WPBeginner

Featured WordPress Plugin
Smash Balloon
Smash Balloon
Add Custom Social Media Feeds in WordPress. Learn More »
How to Start a Blog How to Start a Blog
I need help with ...
Starting a
Blog
WordPress
Performance
WordPress
Security
WordPress
SEO
WordPress
Errors
Building an
Online Store
Useful WordPress Guides
    • 7 Best WordPress Backup Plugins Compared (Pros and Cons)
    • How to Fix the Error Establishing a Database Connection in WordPress
    • Why You Need a CDN for your WordPress Blog? [Infographic]
    • 30 Legit Ways to Make Money Online Blogging with WordPress
    • Self Hosted WordPress.org vs. Free WordPress.com [Infograph]
    • Free Recording: WordPress Workshop for Beginners
    • 24 Must Have WordPress Plugins for Business Websites
    • How to Properly Move Your Blog from WordPress.com to WordPress.org
    • 5 Best Contact Form Plugins for WordPress Compared
    • Which is the Best WordPress Popup Plugin? (Comparison)
    • Best WooCommerce Hosting in 2020 (Comparison)
    • How to Fix the Internal Server Error in WordPress
    • How to Install WordPress - Complete WordPress Installation Tutorial
    • Why You Should Start Building an Email List Right Away
    • How to Properly Move WordPress to a New Domain Without Losing SEO
    • How to Choose the Best WordPress Hosting for Your Website
    • How to Choose the Best Blogging Platform (Comparison)
    • WordPress Tutorials - 200+ Step by Step WordPress Tutorials
    • 5 Best WordPress Ecommerce Plugins Compared
    • 5 Best WordPress Membership Plugins (Compared)
    • 7 Best Email Marketing Services for Small Business (2020)
    • How to Choose the Best Domain Registrar (Compared)
    • The Truth About Shared WordPress Web Hosting
    • When Do You Really Need Managed WordPress Hosting?
    • 5 Best Drag and Drop WordPress Page Builders Compared
    • How to Switch from Blogger to WordPress without Losing Google Rankings
    • How to Properly Switch From Wix to WordPress (Step by Step)
    • How to Properly Move from Weebly to WordPress (Step by Step)
    • Do You Really Need a VPS? Best WordPress VPS Hosting Compared
    • How to Properly Move from Squarespace to WordPress
    • How to Register a Domain Name (+ tip to get it for FREE)
    • HostGator Review - An Honest Look at Speed & Uptime (2020)
    • SiteGround Reviews from 4196 Users & Our Experts (2020)
    • Bluehost Review from Real Users + Performance Stats (2020)
    • How Much Does It Really Cost to Build a WordPress Website?
    • How to Create an Email Newsletter the RIGHT WAY (Step by Step)
    • Free Business Name Generator (A.I Powered)
    • How to Create a Free Business Email Address in 5 Minutes (Step by Step)
    • How to Install Google Analytics in WordPress for Beginners
    • How to Move WordPress to a New Host or Server With No Downtime
    • Why is WordPress Free? What are the Costs? What is the Catch?
    • How to Make a Website in 2020 – Step by Step Guide
Deals & Coupons (view all)
MainWP
MainWP Coupon
Get 15% OFF on MainWP WordPress multisite manager plugin.
Web Hosting Hub
Web Hosting Hub Coupon
Get 44% off Web Hosting Hub hosting plans.
Featured In
About WPBeginner®

WPBeginner is a free WordPress resource site for Beginners. WPBeginner was founded in July 2009 by Syed Balkhi. The main goal of this site is to provide quality tips, tricks, hacks, and other WordPress resources that allows WordPress beginners to improve their site(s).
Join our team: We are Hiring!

Site Links
  • About Us
  • Contact Us
  • FTC Disclosure
  • Privacy Policy
  • Terms of Service
  • Free Blog Setup
  • Free Business Tools
Our Sites
  • OptinMonster
  • MonsterInsights
  • WPForms
  • SeedProd
  • Nameboy
  • RafflePress
  • Smash Balloon

Copyright © 2009 - 2021 WPBeginner LLC. All Rights Reserved. WPBeginner® is a registered trademark.

Managed by Awesome Motive | WordPress hosting by SiteGround | WordPress CDN by MaxCDN | WordPress Security by Sucuri.