WordPress Login Brute-Force Attack
Home
WordPress Login Brute-Force Attack

Telegram message log showing each brute force attempt


What Happened


In June 2025, my personal WordPress website, hosted behind a Cloudflare Tunnel, experienced a significant brute-force attack targeting the default WordPress login page (/wp-login.php). Over the span of 8 hours, the server logs recorded more than 6000 unauthorised GET requests to this endpoint, originating from numerous IP addresses. This case study details the nature of the attack, the mitigation steps taken, and the final security posture achieved.


Crowd under strobe lighting
Real-time Telegram alert showing the flood of brute-force login attempts hitting /wp-login.php from various IPs.

How the Attack Unfolded


The attack manifested as a high volume of automated requests to the /wp-login.php URL, indicating an attempt to brute-force WordPress credentials or to overload the server with login traffic. The logs showed a user agent mimicking Chrome browsers but with unusually high frequency and consistency, typical of botnet activity. The attack leveraged the fact that the default login URL is publicly known, making it a common target for such attacks.


Step-by-Step Defense


  1. Implemented WPS Hide Login Plugin: The default login URL was changed to a unique, non-guessable path. This immediately reduced the number of automated requests to the login page by hiding it from bots scanning for the standard /wp-login.php endpoint.
  2. Configured Cloudflare Firewall Rules: Added rules to block or challenge any traffic attempting to access /wp-login.php and /xmlrpc.php directly. This reduced the attack surface by preventing access to these common attack vectors.
  3. Set Up Two-Factor Authentication (2FA): Installed a lightweight, free 2FA plugin to require a second factor during login. This ensured that even if credentials were compromised, unauthorised access would be prevented.
  4. Enabled Logging of Real Client IPs:
    5. Configured Apache's mod_remoteip to log the true IP addresses behind the Cloudflare Tunnel, allowing better detection and banning of malicious IPs.
  5. Considered Fail2Ban Integration: With accurate IP logging, Fail2Ban rules could be deployed to block repeated attackers at the server level.

Post-Attack Insights


Following these mitigations, the volume of unauthorised login attempts dropped dramatically, and the website remained fully accessible to legitimate users. The attack highlighted the importance of not relying solely on default configurations and demonstrated the effectiveness of layered security approaches.


A graph representing the traffic spike to my website during an attack
Cloudflare dashboard showing a sharp traffic spike during the attack window, mostly targeting login endpoints.

Key Lessons Learnt


  • Change default URLs: Significantly reduces bot-driven attacks.
  • Use Cloudflare firewall rules: Blocks unwanted traffic early in the request lifecycle.
  • Enable two-factor authentication: Critical for securing login credentials.
  • Log real IP addresses: Essential for effective server-level mitigation.
  • Monitor and adapt continuously: Security posture must evolve with threats.

Final Remarks


This case study serves as a reminder that security is a multi-layered process, and proactive measures combined with cloud services like Cloudflare provide robust protection against common web attacks. It also demonstrates the value of quick response and iterative improvements to defend critical web assets.

Home
Contact Contact
Scroll to Top