❗ What Is a Brute Force Attack?

A brute force attack is when a hacker or bot repeatedly tries different username and password combinations until it finds the right one. These attacks are automated — and they target millions of websites every single day.

Example behavior:

• 500+ login attempts in a few minutes
• Failed login attempts from multiple countries
• Repeated attempts on usernames like “admin” or “test”
• Login attempts every second

⚠️ Most brute force attacks are automated — your site could be under attack right now even if you have almost no traffic.

❗ Why Website Owners Get Hacked This Way

Most successful brute force hacks happen because the website owner made one or more of these mistakes:

• Using a weak password
• Using the default username “admin”
• Not enabling 2FA
• No firewall or security plugin installed
• No login attempt blocking mechanism

✔️ The GOOD news: brute force attacks are one of the easiest types of attacks to STOP completely.

✔️ How to Protect a WordPress Website from Brute Force Attacks

Step 1: Change the Default Login URL

By default, the WordPress login page is:

yourdomain.com/wp-admin

Bots attack this URL constantly. You MUST change it.

Recommended plugin: WPS Hide Login

New login examples:

yourdomain.com/access

yourdomain.com/securepanel

Step 2: Enable Two-Factor Authentication (2FA)

Even if your password leaks, 2FA will block the attacker.

Recommended plugins:

• Wordfence
• iThemes Security
• Google Authenticator plugin

Step 3: Limit Login Attempts

This stops bots from trying endless passwords.

Plugin options:

• Limit Login Attempts Reloaded
• WP Security & Firewall
• Wordfence (built-in)

Step 4: Use Strong Passwords

Correct: Sx9$Kwm!3nF/Q7dA
Wrong: admin123, password, 123456

✔️ If you can remember your password easily, it is probably not secure.

Step 5: Remove Unused Admin Accounts

Only one admin should exist. Make other users Editors instead.

✔️ How to Protect a cPanel Login from Brute Force Attacks

Step-by-Step

1. Use a long, complex password
2. Enable Two-Factor Authentication in cPanel
3. Change default cPanel username if possible
4. Disable external access if the account is not used
5. Use IP-based restrictions if available

⚠️ If someone hacks cPanel, they control EVERYTHING: files, database, email, backups, and DNS.

⚙️ Optional but Powerful Security Hardening

• Enable reCAPTCHA on login pages
• Block login access by IP country
• Enable Cloudflare WAF
• Disable XML-RPC in WordPress

 How to Check If You Are Under Brute Force Attack

• Look at Wordfence live traffic logs
• Check cPanel login history
• Review SSH / FTP logs
• Watch for repeated failed login emails

✔️ Most brute force logs will show login attempts coming from multiple countries at once.

⚙️ What Nairahost Already Does to Protect You

• Server-level brute force protection
• Firewall rules that block bad IPs automatically
• Rate limits login attempts at system level
• Account isolation so attackers cannot jump between users

But you still MUST secure your WordPress or app manually.

❗ Final Brute Force Protection Checklist

• ✔️ Custom login URL
• ✔️ 2FA enabled
• ✔️ Login attempt limit enabled
• ✔️ Strong unique password
• ✔️ No extra admin accounts
• ✔️ Firewall plugin active
• ✔️ SSL enabled & forced
• ✔️ XML-RPC disabled
• ✔️ Regular backups