Brute force attacks are one of the most common ways used by hackers to penetrate your website. The way it works is hackers use a bot (a bot is a computer that the hacker controls directly or remotely) to keep trying to log in with different username and password combinations. If time and luck on their side, they will eventually guess the correct combination and get into your website.
Brute force attacks are also called Dictionary Attacks because the hacker tries all possible combinations of dictionary words. That is why you are now asked to include numbers and special characters in passwords.
The stock version of WordPress contains a major security flaw that makes these kinds of brute attacks possible. It allows unlimited login attempts through the login page and even using special cookies.
Before WordPress 3.0 there was always a default username called “Admin”. That means hackers only had to guess the password, which is half the battle. Since WordPress 3.0 and onward you can choose a different default username and you should. Do not use “Admin” as your username.
Changing the user name from admin to something else makes it more difficult for hackers to carry out brute force attacks, but by no means impossible.
Limit Login Attempts Plugin
One of the simplest plugins that provides a solution to this security flaw in WordPress is the Limit Login Attempts Plugin.
Don’t let the fact that it hasn’t been updated in two years scare you. The fact that the login page hasn’t changed much over the years means that the plugin hasn’t needed any updating.
This plugin lets you set a limit on the number of login attempts that are allowed. This limit applies to both, the normal login attempts and the auth cookies. After the specified number of login attempts is reached, the user gets locked out for a period of time that is also chosen by you.
It also lets you extend the lockout period for someone after a certain number of lockouts is reached within a time limit. This plugin sends you email notifications if you wish to be notified when the lockouts reach a specific number. This lets you know when your site is being attacked and to proactively defend it.
However, a common problem with this plugin is that it sometimes locks the owner out as well, making it impossible for them to access their site. Here are some ways in which you can override this plugin, so that you can log back into the site.
Remove Limit Login Attempts via FTP
If you can login to your site via FTP you can delete the plugin which is the simplest solution.
Just login and access /wp-content/plugins/. Once there, delete the limit login attempts plugin or rename the file wp-content/plugins/limit-login-attempts/limit-login-attempts.php.
Remove Limit Login Attempts via wp_options Table
The wp_options table: The options table is also used by numerous WordPress plugins to store plugin settings. Delete the limit_login_lockouts entry from the wp_options table.
Remove Limit Login Attempts via SQL Query
You can run the following SQL query to reset the number login attempts, so that the plugin will allow you to log back in.
UPDATE wp_options SET option_value = ''WHERE option_name = 'limit_login_lockouts' LIMIT 1;
You can also use the query give below to reset the login attempts for a specific IP.
UPDATE wp_options SET option_value = REPLACE(option_value, 'MY-IP', '') WHERE option_name = 'limit_login_lockouts' LIMIT 1;
Remember to replace MY-IP with your own IP address and to update the database table prefix if you have changed it.
Whitelist your own IP
If you do get locked out of your own site, you can use a filter that allows you to whitelist your IP through the PHP files. Then you can simply use the “Restore Lockouts” from the plugin settings and remove the whitelist function.
All in all, Limit Login Attemps is a great plugin and it is often the first line of defense in protecting your site from brute attacks. However, it does tend to lock the site owner out sometimes and the above methods can help you gain access to your site again.