WordPress brute force attacks: how to stop them at the login

matteocisilino — Mon, 02 Nov 2026 08:00:00 +0000

This is how it goes: the site is slow at night and nobody knows why. In the logs there are hundreds of requests to wp-login.php from a handful of addresses, with usernames like admin or the domain name. It is a WordPress brute force attack: no flaw to exploit, just attempts until a password gives way.

What the plugin does against a WordPress brute force attack

Every failed login is recorded: IP, username tried, outcome, time. Never the password. When an IP goes over the threshold you have set, the plugin blocks what looks like a WordPress brute force attack by adding a rule to .htaccess. It is compatible with Apache 2.4 and 2.2. From then on that address’s requests stop at the web server. WordPress is not even loaded, so the site can breathe again.

One detail that matters: the counter is an atomic operation on the database. Sending a hundred attempts at the same instant does not let anyone get past the threshold.

Where to see what happened

In Settings › Cisilino Site Defense Network you will find the blocked IPs tab, where every WordPress brute force attack ends up. It has a filter and the list of the last 50 detections. If a customer locked themselves out, “Unblock” on the row and that’s it.

When there are many IPs

Blocking by IP has a known limit: if the WordPress brute force attack comes from hundreds of different addresses, each one has to cross the threshold first. With the Cisilino network, an IP already seen failing on another of your client’s sites is blocked before it even arrives. In any case, use non-obvious usernames and long passwords. The plugin removes the noise, but it does not make a weak password strong. The OWASP page on blocking brute force attacks is a neutral reference for the general principles.

On nginx hosting the plugin records the attempts but cannot write the rule at server level.

Frequently asked questions

How do you stop a WordPress brute force attack?

By counting failed logins per IP and blocking whoever goes over a threshold. The plugin does it by writing a rule in .htaccess, so the request stops before WordPress.

Does the plugin store the passwords that were tried?

No. It records the IP, the username tried, the outcome and the time, never the password.

Can I unblock an IP that was blocked by mistake?

Yes, from the blocked IPs list with the Unblock button on each row.

The post WordPress brute force attacks: how to stop them at the login first appeared on Matteo Cisilino.

WordPress login - Matteo Cisilino