Brute Force Attack | What is a Brute Force Attack?

TL;DR Brute Force Attack

A brute force attack is one of the most common and straightforward forms of cyberattack. An automated script repeatedly attempts to guess a username and password combination by trying thousands or even millions of combinations in rapid succession until it finds one that works. WordPress sites are a particularly frequent target because the default login URL is publicly known. CloudSonic blocks brute force attempts automatically through our WAF and bot protection layers, rate limiting login requests before they can cause damage. This is also why using a strong unique password and enabling two factor authentication on your account is strongly recommended.

How a Brute Force Attack Works

A brute force attack is executed by automated software that systematically generates and tests login credential combinations at a speed no human could match. A basic attack might try every word in a dictionary, which is why this variant is called a dictionary attack. A more thorough attack tries every possible combination of characters up to a certain length. Modern brute force tools can test thousands of combinations per second and are freely available, meaning even unsophisticated attackers can run them. WordPress sites are a particularly common target because the default login URL is publicly known and the username is often the site administrator's display name, which is visible on the site itself. This means attackers only need to crack the password, cutting the problem in half.

Credential stuffing is a related variant where attackers use lists of username and password combinations leaked from other data breaches, betting that people reuse the same credentials across multiple sites. This is often more effective than pure brute force because the credentials are already known to work somewhere. The defence against both attacks is the same: rate limiting login attempts, blocking suspicious IP addresses, using strong unique passwords, and enabling two factor authentication.

Frequently Asked Questions on Brute Force Attack

How can I tell if my site has been targeted by a brute force attack?

Check your access logs for repeated POST requests to wp-login.php or xmlrpc.php from the same IP address or a range of IP addresses in quick succession. You may also notice failed login notification emails if you have that enabled, or legitimate users being locked out because rate limiting triggered by the attack is affecting everyone.

Does a strong password prevent brute force attacks?

A strong password makes a successful brute force attack computationally infeasible but it does not stop attackers from trying, and those attempts still consume server resources. Rate limiting and WAF rules that block repeated failed attempts are the correct mitigation because they stop the attack before it generates significant load rather than just making the attack unlikely to succeed.

What is the difference between a brute force attack and a dictionary attack?

A brute force attack tries every possible combination of characters systematically. A dictionary attack tries a predefined list of common passwords, words, and known leaked credentials. Dictionary attacks are far more efficient in practice because most people use common passwords, which is why credential lists from data breaches make them particularly effective against sites where users reuse passwords.

Is XML-RPC the main target for brute force attacks on WordPress?

It is one of the most targeted entry points because it allows hundreds of login attempts to be bundled into a single HTTP request using the multicall method, which amplifies the attack significantly. Blocking access to xmlrpc.php entirely via the WAF is the recommended approach for any WordPress site that does not specifically need XML-RPC functionality.