How to Stop a WordPress Brute Force Attack: 8 Proven Steps (2026)
In April 2013, a botnet using over 90,000 IP addresses hammered WordPress sites worldwide, guessing passwords for the “admin” account. Hosts like HostGator warned customers and Cloudflare pushed emergency rules to block it. A WordPress brute force attack is still one of the most common threats today, but it’s easy to defend against. Here’s how in 2026.
Quick answer: Use a unique username (not “admin”) and a long, unique password, turn on two-factor authentication, limit login attempts, put a web application firewall in front of your site, and disable or restrict XML-RPC if you don’t use it. Keep WordPress and plugins updated.
Table of Contents
What is a WordPress brute force attack?
Bots try thousands of username and password combinations on your login page (wp-login.php) or through XML-RPC until one works. Even failed attempts can slow your site and overload the server.
Signs your site is under attack
- A slow admin area or login page.
- Many failed login alerts from your security plugin.
- Spikes of POST requests to wp-login.php or xmlrpc.php in server logs.
- Warnings from your host about high resource use.
8 steps to stop a WordPress brute force attack
1. Don’t use “admin” as a username
Create a new administrator with a unique name, log in as it, and delete the old admin account (assigning its posts to the new user).
2. Use strong, unique passwords
Use a password manager to generate passwords of 16+ characters for every user.
3. Turn on two-factor authentication
Plugins like Wordfence, Solid Security or Two Factor add authenticator app or passkey login.
4. Limit login attempts
Lock out IPs after a few failed tries with a security or limit-login plugin.
5. Use a firewall
A cloud firewall such as Cloudflare or Sucuri blocks bad traffic before it reaches your server. Many hosts include bot protection too.
6. Protect XML-RPC
If you don’t use the mobile app or Jetpack features that need it, disable XML-RPC with a security plugin or block xmlrpc.php at the server.
7. Add CAPTCHA or protect wp-login.php
Add Cloudflare Turnstile or reCAPTCHA to the login form, or password protect the login directory on the server.
8. Keep everything updated
Update WordPress, themes and plugins promptly. Hiding details like your WordPress version helps a little, but updates matter more.
Compare tools in our list of WordPress security plugins, and see the WordPress brute force guide (external site).
FAQ
Can a brute force attack hack my site?
Only if a password is weak or reused. Strong passwords and 2FA make success extremely unlikely.
Should I change my login URL?
It can reduce bot noise, but it’s not a substitute for strong passwords, 2FA and a firewall.
Does Cloudflare stop brute force attacks?
Its firewall and bot rules block much of it, especially with rate limiting on wp-login.php.
Stuck on a gift? Try our free Gift Idea GeneratorIdeas for anyone by age, job, interests and budget, with Amazon.com and Amazon.in linksFind gifts →Get our free weekly email: new tech guides and tools, no spam.
New and updated tech guides, a free tool worth bookmarking and one useful pick, once a week. No spam, unsubscribe anytime.
One email a week. Unsubscribe anytime. See our privacy policy.
I have a doubt about the last precaution. Because updating the WP version causes compatibility issues. Nevertheless, great information.
Nothing will beat a strong password I say, it is one of the most essential security tips. Also eliminating ‘admin’ role is recommended.
Not all the times Pradeep. I used unbreakable password but still my blog got affected. I’m HostGator user.
As it’s a nightmare to remember difficult passwords with numbers, why not stick to a password where you can easily and naturally use numbers and letters eg “Division” becomes d1v1s10n
It is a great idea. But now I think a lot of people are aware of that trick, and can try it out to guess passwords.
I also changed my username (admin) in Phpmyadmin. because of this DDoS attack my blog had down times.
Thanks For Update. Mostly user don’t change their username and they faces this type of problem.
Thanks for the update. Fortunately, I’m not a victim of this attack yet now :).
I wanted to change my admin user for a long time. This was a good motivating event to do that.
Yes, I heard that the WordPress sites that were having the default username i.e. “Admin” became the victims of this attack. It was good that I was not having that on any of my sites :).
#PrIyAnGsHu
I got mail from my host , it says the purpose of the attack isn’t entirely clear, but as security researcher reports, currently most of the attacks seem to be sourced from PCs, not servers. The attack seems to install a “backdoor [that] lets the attackers control the site remotely.” Those backdoors will presumably be used to some followup attack at a later date, and in theory could cause more damage than a PC-based botnet attack.
Thanks God, we have done this before. looking to install some security plugin. Thanks for an alert.
We all should install some WordPres security plugins
I would NOT recommend any plugins to try to block an attack of this scale. Wordfence and similar plugins that execute another PHP process or worse, also write to the database for each IP and login, will very likely crash your server or at least slow your site to a crawl.
Follow this guide if your site was attacked (wp-login.php several times in your access logs):
http://calladeveloper.blogspot.com/2013/04/global-wordpress-brute-force-attacks.html
Unfortunately Wordfence is likely to crash the server or cause other major problems if you use it to try to block a large scale attack like this.
No plugin is likely to have any effect, they are using one IP per login attempt, so anything IP based will not work. Most hosts have mitigated with some success, although the attackers quickly change tactics every time a new security measure is put in place, so it is a constant battle to keep the attack “muffled”.
The main issue now is there are infected sites infecting computers all over the place, and the malware dropped on computers infects other sites (without necessarily using the login brute-force).
Affected users should follow this guide to properly respond to the attacks – the main point is to change the admin username to something difficult to guess:
http://calladeveloper.blogspot.com/2013/04/global-wordpress-brute-force-attacks.html
The guide also explains how to “reset” a hacked WordPress site and links to several useful resources for site owners about WordPress security.
Thanks for your feedback on the plugins.
they are targeting the blogs whose username starts with ADMIN so the best thing will be change your username from admin to something else.
That’s right. They are targeting the default Admin username.