Brute force and credential stuffing: why your login gets attacked

Two kinds of attack

Both are automated and aimed at whatever login pages bots can find: WordPress admin, email, hosting control panels, store accounts.

• Brute force: trying many passwords against one account, often with common passwords.
• Credential stuffing: trying email and password pairs leaked from other sites’ breaches. It works because people reuse passwords.

What makes them useless

• Two-step sign-in on every admin and email account.
• Unique passwords from a password manager.
• Limits on login attempts, and temporary blocks after repeated failures.
• Login names not exposed publicly. See the WordPress security checklist.
• Removing logins nobody uses: old users, old FTP accounts.

Signs it’s working against you

• Alerts about sign-ins from unfamiliar places.
• Accounts locked out for no reason.
• Your host warning about load from login requests.