Stopping WordPress Brute Force Attacks

Introduction: The Epidemic of Credential Stuffing

Your wp-login.php page is under constant attack. Cybercriminals purchase massive databases of leaked passwords from other breaches and use automated scripts to try those exact email/password combinations against your WordPress site. This is known as Credential Stuffing, and it is highly effective.

The Impact of Brute Force Attacks

Even if attackers fail to guess your password, the sheer volume of login attempts (often hundreds per second) will spike your CPU usage, exhaust PHP workers, and drastically slow down your site for legitimate visitors.

Defense Layer 1: Two-Factor Authentication (2FA)

The single most effective way to stop unauthorized logins is by enforcing Two-Factor Authentication. Even if an attacker steals your password, they cannot access your account without the physical token generator (your smartphone).

Implementing TOTP (Time-Based One-Time Passwords)

Nexura Security supports TOTP natively. It generates a cryptographic seed that you scan with Google Authenticator or Authy. The algorithm generates a new 6-digit code every 30 seconds.

$totp = new \OTPHP\TOTP($user_secret);
if ($totp->verify($user_provided_code, time())) {
    // Grant access
} else {
    // Deny access
}

Defense Layer 2: Rate Limiting and IP Bans

To prevent attackers from guessing your 2FA codes or exhausting server resources, you must implement strict rate limiting.

• Thresholds: Limit failed logins to 3 attempts within a 5-minute window.
• Progressive Delays: Add a 2-second delay to the login response after the first failed attempt. This destroys the efficiency of automated brute-force scripts.
• Permanent Bans: If an IP address fails 10 times in an hour, ban it at the firewall level.

Defense Layer 3: Custom Login URLs

Security through obscurity is not a replacement for real security, but it is an excellent supplementary layer. By changing your login URL from /wp-login.php to something unique like /my-secure-portal, you instantly drop 99% of automated bot traffic.

location = /wp-login.php {
    deny all;
    return 403;
}

Conclusion

Protecting your identity is the cornerstone of WordPress Security. Enforce strong passwords, mandate 2FA for all administrators, and utilize a WAF to block malicious IPs automatically.

About the Author: The Nexura IAM (Identity and Access Management) Team specializes in zero-trust architecture for WordPress environments. Updated: August 2026.