WordPress Brute Force Attack

Hello TCH’ers,


Here’s What We Are Doing:




Here’s What You Can Do:



Limit Login Attempt: We recommend limiting login attempts to your WordPress Dashboard. There are various plugins that can help accomplish this. Here is an example of one: http://wordpress.org/extend/plugins/limit-login-attempts/




Edit: The attack is so widespread and well known that even magazines are covering it! http://www.pingzine.com/wordpress-admin-accounts-targeted-by-botnet-23840/

Share Button

10 thoughts on “WordPress Brute Force Attack

  1. Mark,

    We are fully aware of the implications and this is not a permanent solution. Our concern is really not with what methods that are “recommended” but with the overall health of server farm and all of our clients. We temporarily chose to do this as the server loads were making sites completely inaccessible., which is much worse than not being able to log in.

    However, you will notice that we have already flipped back access as we pushed out new rules again. These rules are working much better than the ones that we had in place, but should we need to block access again, it is an option we may have to use.

    Thanks for the feedback and rest assured we are listening.

  2. TCH-Dick – thanks for the update. We recognize that dealing with this stuff isnt fun. There’s a reason why you’ve been my webhost for going on 13 years:)

  3. Mark,
    You are welcome.
    One of the things that these all out block do is let us gather new data and adjust our rules. However, this time we thought we post it all up and get everyone in the loop.

  4. Cloudflare is another option to consider. I read on their blog that security rules were added for both paid and free customers. This should help filter out the brute force attack.