{"id":160,"date":"2026-11-02T09:00:00","date_gmt":"2026-11-02T08:00:00","guid":{"rendered":"https:\/\/www.cisilino.com\/?p=160"},"modified":"2026-11-02T09:00:04","modified_gmt":"2026-11-02T08:00:04","slug":"wordpress-brute-force-login","status":"publish","type":"post","link":"https:\/\/www.cisilino.com\/en\/2026\/11\/02\/wordpress-brute-force-login\/","title":{"rendered":"WordPress brute force attacks: how to stop them at the login"},"content":{"rendered":"

This is how it goes: the site is slow at night and nobody knows why. In the logs there are hundreds of requests to wp-login.php<\/code> from a handful of addresses, with usernames like admin<\/em> or the domain name. It is a WordPress brute force<\/strong> attack: no flaw to exploit, just attempts until a password gives way.<\/p>\n

\"WordPress<\/figure>\n

What the plugin does against a WordPress brute force attack<\/h2>\n

Every failed login is recorded: IP, username tried, outcome, time. Never the password. When an IP goes over the threshold you have set, the plugin blocks what looks like a WordPress brute force attack by adding a rule to .htaccess<\/code>. It is compatible with Apache 2.4 and 2.2. From then on that address’s requests stop at the web server. WordPress is not even loaded, so the site can breathe again.<\/p>\n

One detail that matters: the counter is an atomic operation on the database. Sending a hundred attempts at the same instant does not let anyone get past the threshold.<\/p>\n

Where to see what happened<\/h2>\n

In Settings \u203a Cisilino Site Defense Network<\/em> you will find the blocked IPs tab, where every WordPress brute force attack ends up. It has a filter and the list of the last 50 detections. If a customer locked themselves out, “Unblock” on the row and that’s it.<\/p>\n

When there are many IPs<\/h2>\n

Blocking by IP has a known limit: if the WordPress brute force attack comes from hundreds of different addresses, each one has to cross the threshold first. With the Cisilino network, an IP already seen failing on another of your client’s sites is blocked before it even arrives. In any case, use non-obvious usernames and long passwords. The plugin removes the noise, but it does not make a weak password strong. The OWASP page on blocking brute force attacks<\/a> is a neutral reference for the general principles.<\/p>\n

On nginx hosting the plugin records the attempts but cannot write the rule at server level.<\/p>\n

Frequently asked questions<\/h2>\n

How do you stop a WordPress brute force attack?<\/h3>\n

By counting failed logins per IP and blocking whoever goes over a threshold. The plugin does it by writing a rule in .htaccess, so the request stops before WordPress.<\/p>\n

Does the plugin store the passwords that were tried?<\/h3>\n

No. It records the IP, the username tried, the outcome and the time, never the password.<\/p>\n

Can I unblock an IP that was blocked by mistake?<\/h3>\n

Yes, from the blocked IPs list with the Unblock button on each row.<\/p>\n

Read more<\/h2>\n