WordPress glossary
Brute Force Attack
An attacker trying thousands of password guesses against your WordPress login page.
Reviewed by Ali Yasin Jatoi · Updated
Brute force attacks hit /wp-login.php and the xmlrpc endpoint with credential lists harvested from data breaches. They are constant background noise on every WordPress site. Login limits, 2FA, and unique admin usernames block them.