How to Prevent Brute Force Attack in WordPress?
Brute force attack is the method of trying to unlock the password protected webpages by trial and error method. Hijackers use complicated bots to guess the username and password on the forms on login, registration and other pages and try to take over the site. The bots continuously attempt to guess the credentials and put lot of load on your server. So even if you are not thinking from security perspective it is essential to block those bots / users in order to reduce the load on your hosting server. In this article let us discuss how to prevent brute force attack in WordPress.
Using Jetpack Plugin for Brute Force Prevention
Jetpack offers many modules and "Protect" is one of the module prevent brute force attacks. You can just activate the "Protect" module to stop brute force attacks on your WordPress site.
Deactivate Jetpack Protect
When enabled, Jetpack will automatically shows a mathematical captcha on the admin login page and stops the bots. In addition you can also configure IPs under whitelist management. Only whitelisted IPs will be allowed to access your WordPress login page and all other IPs will be blocked from login to admin dashboard.
IP Whitelisting with Jetpack Plugin
Brute Force Prevention with All in One WP Security & Firewall Plugin
Jetpack's brute force prevention is very simple and does not have many other options. All in One WP Security & Firewall plugin is one of the popular and free security plugin helps to protect your WordPress site effectively. Install and activate the plugin from your WordPress dashboard. It will create a new menu "WP Security" on the admin dashboard's sidebar.
Finding All in One WP Security and Firewall Plugin
The plugin measures the security of your site on points scale and activating individual security options will add up the points. In order to prevent brute force, navigate to "WP Security > Brute Force" section to see multiple options like below:
Brute Force Attack Prevention Options
Ensure to have the followings before processing with any of the security settings:
- Backup the entire site with site files and database. The plugin will create database tables and modify site files like .htaccess.
- Ensure you have FTP access to your hosting server. This is required to restore the files when you are locked out of your admin dashboard and not able to login.
- Enable only if the option is applicable and required for you.
Rename Login Page
WordPress login page can be easily accessed by adding the suffix "/wp-admin/" or "/wp-login.php?action=login" to your site. Since anyone can access your site with one of these URLs, the first step in brute force prevention is to rename the login page. Check the "Enable Rename Login Feature" box and provide the desired string which is hard to guess.
Rename WordPress Login Page
For example, if you want to change the login page URL to like "yoursite.com/login/" then enter the word "login" in the text box.
1. Renaming login page will log you out and you need to login again with the new URL.
2. This function will affect all the users, hence do not activate if you have user registration or registration required for commenting on your site.
3. This function will affect the feature of any other plugins using default login page.
Cookie Based Brute Force Prevention
The second option is to prevent brute force attacks based on the cookie available on the browser. Enable the check box "Enable Brute Force Attack Prevention" and provide the secret word on the next "Secret Word" text box.
Cookie Based Brute Force Login Prevention for WordPress
For example, if you want to add the secret word as "test" then the login URL will be "http://yoursite.com/?test=1". You can add "/?secret-word=1" to your site URL to access the login page.
In addition you can set the "Re-direct URL" to redirect the unauthorized users to that page. Generally you can set this as localhost IP address "http://127.0.0.1" to prevent load on your server. If you have password protected pages then enable the checkbox "My Site Has Posts Or Pages Which Are Password Protected".
If you have a theme or plugin uses Ajax then enable the checkbox "My Site Has a Theme or Plugins Which Use AJAX". Generally most of themes and plugins use Ajax, hence you should enable this option and test whether your site is loading properly.
1. This method is similar to the rename login page so all warnings mentioned above are applicable for this method as well.
2. Since both "rename login page" and "cookie based brute force prevention" methods will change the login page URL, you can use either of the one method at a time on your site.
Login Captcha
Since the first two options will affect multiuser environments like sites with login, registration and ecommerce features, just enabling captcha is one of the simplest method you can use to stop brute force attack. Under this section you have three options to enable mathematical captcha on the forms:
- Enable captcha on default WordPress login page.
- Enable captcha on all forms used on the site that uses the WordPress function "wp_login_form()".
- Enable captcha on lost password request form.
Login Captcha Settings in All in One WP Security Plugin
Login Whitelist
Similar to Jetpack's whitelist management, All in One WP Security & Firewall plugin also offers "Login Whitelist" option. This will allow only the listed IP addresses to access your WordPress login page and all other IP addresses will be blocked.
Login IP Whitelisting with All in One WP Security Plugin
Honeypot
The last option is to enable "Enable Honeypot On Login Page". This will set a new field on the login form which will be invisible to human users and visible only to the bots. Since robots used to fill all the fields on the login form, the plugin will stop access if the hidden field is filled. Thus helps to stop the robots effectively.
Honeypot Settings for WordPress Login Page
Conclusion
All in One WP Security & Firewall plugin offers exhaustive ways to secure your WordPress site. Though this looks attractive, ensure to test each feature and use only if it is required for your site. Rename login page, cookie based option and IP whitelisting can be used on a single user sites having no user registration. Remaining options like enable login captcha and honeypot can be used on all types of sites without any issues.
You can also use "Jetpack" and "All in One WP Security & Firewall" plugins together for stopping brute force attacks on your site.