Waking up to discover that hackers have taken over your website is one of those frustrating experiences no one would want to face. To avoid becoming the next victim of the ever-growing number of hacks, you must protect your website from all the different kinds of attacks, including prevalent ones like brute-force attacks.
Brute force attacks are responsible for 5% of all data breaches, and among breaches caused by hacking, 80% involve brute force attacks or compromised credentials. The good news is that protecting your site against brute force attacks can be done in just a few minutes if you have the right tools. Let me briefly explain a few basics about brute force attacks.
What is a Brute Force Attack?
A brute force attack is a method hackers use to gain unauthorised access to a system by repeatedly trying different combinations of usernames and passwords until the correct one is found. These attacks are usually not done manually, as it would take way too long to guess the right combination. Instead, attackers use automated tools to test thousands or even millions of credential combinations quickly.
If successful, a brute force attack can have severe consequences, including unauthorised access to sensitive information, data breaches, and disruption of website functionality. These outcomes can damage a business’s reputation, result in financial losses, and even lead to legal issues if customer data is compromised. The risks associated with brute force attacks are why website owners and admins must implement the steps I am about to share.
Steps to Protect Your Website Against Brute Force Attacks
Changing the Login Page URL
The default login page URL for popular platforms like WordPress is widely known, making it an easy target for brute force attacks. For WordPress, the default login page is typically “yourwebsite.com/wp-admin.” Anyone visiting that page can directly access the login form and attempt various username and password combinations to get access to the site’s backend.
By hiding or changing this URL, you greatly reduce the likelihood of attackers or their bots finding and exploiting the login page. Tools like the WPS Hide Login plugin make it easy to customise the login URL without requiring advanced technical skills. Simply install the plugin and change the default login page to a unique URL.
For example, instead of using the default “yourwebsite.com/wp-admin,” you can change it to something like “yourwebsite.com/supersecurelogin.” This will confuse automated bots programmed to target default login pages, minimising the attack surface. However, be sure to choose a URL you can easily remember since you’ll need it to access your site’s backend in the future.
Disabling XML-RPC
For those who may not know, XML-RPC (Extensible Markup Language Remote Procedure Call) is a WordPress feature that allows remote connections between your website and external applications via HTTP. While useful for some functionalities, like enabling mobile app access or posting to your site via email, it is often unnecessary for most websites.
Unfortunately, attackers frequently exploit XML-RPC to perform brute force attacks, leveraging its capability to attempt multiple password combinations quickly. You can disable XML-RPC on your site by adding the following small code snippet to the .htaccess file:
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>
You can find the .htaccess file in the WordPress folder of your website using your hosting provider’s file manager. Disabling XML-RPC on sites that do not need it makes your website more resilient to brute force attacks while improving overall security.
Limiting Login Attempts
Limiting login attempts is an effective way to prevent brute force attacks by restricting the number of times someone can enter incorrect login credentials. You can use a plugin like Limit Login Attempts to enforce this by blocking repeated failed attempts and locking out suspicious users.
Once the Limit Login Attempts plugin is installed on your site, go to its settings and specify the maximum number of incorrect login attempts allowed before users are locked out for a period you define. You can also create a whitelist and denylist of IP addresses and usernames to automatically allow or block. In addition to these features, plugins like Limit Login Attempts provide logs and notifications of login activity, helping you monitor and respond to potential threats in real time.
Additional Best Practices
These are more measures you can use to further strengthen the security of your website:
- Use strong and unique passwords: Create complex passwords with a mix of letters, numbers, and symbols to make them harder to guess. Avoid reusing passwords across different sites to reduce the risk of widespread compromise.
- Enable two-factor authentication (2FA): This adds an extra security layer by requiring a second form of verification (such as a code sent to your phone) in addition to your password, making it much harder for attackers to access your account.
- Regularly update website software, themes, and plugins: Keeping your website’s components up to date ensures that known security vulnerabilities are patched, reducing the risk of exploitation by attackers.
- Monitor server logs for suspicious activities: Regularly reviewing server logs helps you spot unusual behaviours, such as multiple failed login attempts, which may indicate an ongoing attack, allowing you to take action early.
Key Takeaway
Website security is often overlooked by their owners and admins, which is why thousands get hacked daily. The steps I’ve shared in this article are simple to follow. Most importantly, the plugins mentioned in this article have free versions that offer all the capabilities I have shared. Remember, the time and money it takes to set up security measures is far less than what you’d spend recovering from an attack. Sadly, this is why many small businesses never bounce back after a cyberattack. Studies show that about 60% of small businesses fail to recover and shut down within six months of a cyberattack – don’t be one of them.