No products in the cart.
Protecting your password from brute-force attacks
One of the most common and easiest ways to compromise a website is to guess the password to log in to its Content Management System (CMS). For example, / wp-admin for WordPress.
Malware will use trial and error to try to guess your password.
It can be started by cycling through the most common forms of passwords. This is known as a dictionary attack: where the code circulates through all the words in the ‘password dictionary’, using common words and passwords that have already been used elsewhere.
That’s why you should use a unique, secure password: one that is really random. This makes it difficult for them to remember – unfortunately – but there are password managers who can help.
Then comes the traditional brute force attack, where the code tests the combination of each character in sequence. Even if your password is random, these types of attacks have a good chance of getting it right over time.
How StackProtect protects your password
StackProtect monitors requests for common login pages. When requested, it looks at several things:
- Publicly blacklisted domains and IPs
- Unusual geographical location (from IP address)
- Previous login attempts by this host.
- The number of login attempts, and how many websites have been accessed.
- Failed login and breaking previous firewall rules
If these criteria match, we will apply Google’s latest reCAPTCHA tests. In most cases, it provides a decision on whether or not to allow login. For brutal force attacks, they will be stopped.
In rare cases where Google tools can’t make a decision, the user will be presented with a traditional captcha box like this:
A splash page is presented before completing any CMS code. This happens on physically isolated servers, so malware can’t access your site’s basic data.
This combination of our check and Google’s check prevents brute force scripts in its tracks.
Attacks by brutal force are very, very frequent. For example, in the first 3 weeks of August 2018, we made between 2.25 million and 5.5 million attempts – every day!
This is just one of the ways we can help keep you safe.
Unfortunately, there are data breaches every day and no one can promise to keep you 100% safe. Even so, there are many other ways you can limit the damage caused by cybercrime. We recommend using multi-factor authentication, physical security tokens and / or biometric methods (such as fingerprints and retina scans) where possible.
Protecting your passwords is an important part of cybersecurity, but it’s also important to make sure your site is secure. Read our comprehensive WordPress security guide to learn more about how you can prevent and reduce the risk of hackers.
