If you've ever installed a security plugin and looked at the failed login log, you probably got a fright: hundreds or thousands of attempts to reach your admin panel, from addresses all over the world, on sites nobody has heard of. The first reaction is usually to assume someone is targeting you. The reality is more boring and more reassuring: nobody picked you, there are bots sweeping the entire internet and your site was simply on the list.
What a brute force attack is
It's the most primitive method there is: trying username and password combinations one after another until one works. There's no cleverness, only volume. An automated program can try thousands of combinations per hour, always starting with the most likely: the user "admin" with passwords like 123456, the word "password," or the domain name.
There's a smarter and harder-to-detect variant: instead of trying a thousand passwords against one user, it tries a single very common password against a thousand different sites. Since each site sees just one failed attempt, no alarm fires, and yet the statistics work in the attacker's favor.
Why it hurts you even when they never get in
This is the part most people overlook. Even if your password is impenetrable, every login attempt consumes real server resources: it loads the system, queries the database, processes the validation. A thousand attempts an hour is equivalent to a thousand phantom visitors who buy nothing and who do compete with your real visitors for the same processor.
On shared hosting that has a very concrete consequence: if your account exceeds its resource limit because of an attack, you're the one who suffers. Your site slows down, starts throwing service unavailable errors, and in extreme cases the provider suspends processes. The attacker never got in, but they hurt you anyway.
The seven measures that actually work
1. Delete the "admin" user. It's half the attacker's job solved in advance. Create a new administrator with a name nobody would guess, log in with it, and delete the old one, reassigning its content. Don't use your public name as the username either: in many systems the author name appears in post addresses, so you'd be publishing it.
2. Long passwords beat complicated ones. A twenty-character password made of four random words is vastly harder to crack than eight characters with odd symbols, and you can actually remember it. What matters is length and uniqueness: reusing your email password on the hosting panel is the most common way somebody else's breach becomes your problem.
3. Two-step verification. By a wide margin, the highest-impact measure for the least effort. With it enabled, the password stops being sufficient: even if they guess it, they don't get in. Turn it on for the hosting panel, the site manager, and the associated email account, which is usually the forgotten back door.
4. Limit login attempts. Three or five failed attempts and the address is blocked for a while. This turns an attack of thousands of attempts per hour into one of five, which makes it useless in practice. It's the measure that saves the most resources.
5. Change the admin address. If your login form isn't where every bot looks by default, most of them won't even find you. It isn't real defense against someone determined, but it eliminates ninety-something percent of the automated noise in one move.
6. Protect access at the server level. Adding a server-level password layer over the admin folder means attempts never even reach your code. It's the most resource-efficient measure, because the attack is stopped before it starts. You configure it from the hosting panel in a few minutes.
7. Keep everything updated. Many attacks that look like brute force actually exploit a known flaw in an outdated plugin. Updates aren't a nuisance: they're the patch on a door someone already knows how to open.
What to do if you suspect they got in
The typical signs are administrator users you didn't create, posts or pages appearing on their own, strange redirects visible only from a phone or from search results, bounced emails for messages you never sent, and warnings from your provider about abnormal resource usage.
If you see any of that, order matters. First change every password: hosting panel, site manager, database, FTP and email. Second, review and delete any administrator accounts you don't recognize. Third, run a full malware scan. Fourth, and only then, restore a backup from before the problem started. And fifth, the step almost everyone skips: find out how they got in, because if you restore without closing the hole, they're back within days.
What not to do
Don't get obsessed with blocking entire countries: it's crude, it blocks legitimate visitors, and attackers change origin effortlessly. Don't stack five security plugins: they trip over each other, consume resources, and give you a false sense of protection. And don't confuse hiding with protecting: changing the admin address reduces noise, but if your password is weak, real security is still zero.
How to tell an attack from ordinary noise
Not every spike in failed attempts deserves the same reaction, and knowing the difference saves a lot of unnecessary anxiety. A steady background of twenty or fifty daily attempts against the user "admin" from constantly changing addresses is simply internet weather: automated scanning that hits every site with a login form. You close the doors described above and you stop thinking about it.
What does deserve attention is a different pattern: attempts against a username that actually exists on your site, especially one that isn't published anywhere. That means somebody enumerated your users, which is a step beyond blind scanning. The same goes for a sudden burst of thousands of attempts within minutes, concentrated on one account, or attempts arriving through the programmatic access endpoint rather than the visible login form, which is a favorite path precisely because so few people watch it.
In those cases the sensible move is to change that account's password immediately, verify two-step verification is active on it, and check the account's recent activity for anything you didn't do.
The hosting's role in all this
A good part of this battle is fought before the request ever reaches your site. Hosting with denial-of-service protection filters malicious traffic at the network level, before it touches your account. Server-level antimalware detects infected files even if you never check. And daily backups on separate hardware turn the worst-case scenario into an afternoon of work instead of a total loss.
That's why I recommend BanaHosting: it includes DDoS protection, antimalware scanning and daily JetBackup copies stored on hardware separate from the main server, plus cPanel to set up password-protected folders in two clicks. The 24/7 support via chat, ticket and phone answers in under 10 minutes, which is exactly what you need when you discover a security problem on a Sunday night. With 19 years in the business and more than 100,000 sites hosted, they've seen all of this thousands of times. Plans start at $4.95 a month with a 30-day guarantee.