A brute force attack utilizes trial-and-error to guess login information and encryption keys or find a hidden web page. Cyberpunks work via all possible varieties expecting to guess correctly.
The following are the Effective Strategies Against Server Brute Force Attacks:
- Microsoft Windows Firewall
- CSF Firewall
- Use Strong Passwords
- Strengthen Your Login Process
- Use Captcha
So Mister Security Research
@Clay_P
How 3. will prevent brute force attacks? I can have a 200 length text strong password and brute force attacks will continue. That is not the point.
That is a security pratice, not a prevention of "Brute Force", even with "strong" / mild / low passwords security you will receive brute force, you can't stop it with strong password lol.
That is a mistake you should edit and telling that won't be effective against brute force.
1. What the hell? Windows Firewall in Linux?
Have a nice day
----- Message to OP
@Epicster --------
I read some messages here that are a little "stupid" sorry to say that, is not to be rude with anyone, but some people really needs to understand what is a brute force attack.
Brute Force attack don't end even if you have a strong password, strong password is to prevent brute force to discover your password, but won't prevent him to still trying.
The best to do is avoiding any nulled plugin or theme, it can have backdoors. Also a lot of plugins you shouldn't use. Wordfence is enough.
1 ) Use Cloudflare and add your URL login page to Under Attack with CAPTCHA with validation of 30min or 1h.
2) Change URL of your login admin area to other (please don't use a plugin to do this, you can do through phpmyadmin oy MySQL command in DB)
3) You use Nginx or Apache? Use Directory Password like this:
https://ubiq.co/tech-blog/how-to-password-protect-directory-in-nginx/4) Fail2ban or other firewall and increase time ban for more hours or days.
5) Check which is the country that is doing "high brute force attacks" and do IPGeo Blocking or ASN Blocking (this is very effective).
6) If you are using or you had used nulled plugins, themes you can expect brute force attacks.
7) Nginx Rate Limiting (cloudflare also have rate limiting for free in some pages use it in login)
8) Blacklist all IPs from accessing your login page, and allow only your IP Range.
TL;DR:
Always will be someone doing that even if you block 90%, you always will be target by automation bots doing brute force and scanning IPs in Internet.
Accept, prevent and pratice a hardening security.
Just use that in your login page or hire someone to do it, however is not difficult.
