Brute-force login attack

A brute-force attack tries many username and password combinations against a login page until one works. A close relative, credential stuffing, tries email and password pairs leaked from other websites, hoping people reused them.

The attacker does not need any special flaw in your website. A login form, a guessable password and no limit on attempts are enough.

1. The attacker finds your login page, often at predictable addresses such as /login or /wp-login.php.
2. A script submits guesses automatically: common passwords, or pairs from a leaked list.
3. If the site allows unlimited attempts and gives different answers for wrong usernames and wrong passwords, the script learns which accounts exist.
4. When a guess works, the attacker logs in as that user, and may then reuse the access for further attacks.

• Many requests to your login URL from one IP address in a short time.
• A burst of failed logins, often for many different usernames.
• Account lock-out complaints from real users.
• Successful logins from unfamiliar locations soon after a burst of failures.

• Account takeover, including admin accounts.
• Access to private customer data.
• Compromised accounts used to send spam or attack others.
• Server load and slow logins for genuine users.

• Limit login attempts: slow down or temporarily lock an account after a few failures.
• Turn on two-factor authentication, at least for admin accounts.
• Require long passwords and reject known leaked ones.
• Use the same error message for a wrong username and a wrong password.
• Add a CAPTCHA or similar check after repeated failures.
• Rate-limit by IP address, and watch for logins from unusual places.

Not sure how your own site looks from outside? Run the free website security scanner.

Rakshak counts how often a single IP address requests URLs that contain the words login or signin within a few minutes. When the count goes above a threshold, it raises a brute-force alert.

This works with any website where the login address contains one of those words, including common WordPress login addresses.

• Every detection creates an alert in your Rakshak dashboard with the IP address, the request that triggered it, the severity and the time.
• If you have connected Telegram, Rakshak also sends you a message. You choose which severities you want to be told about.
• Repeated alerts of the same type from the same IP address are grouped for ten minutes, so you are not flooded with duplicates.
• Brute-force login attack is a high-severity detection. It raises an alert but does not block anyone automatically, because it can also come from harmless visitors. You review it and, if you agree, add the IP address to your blocklist on the IP management page.
• Blocking needs the Rakshak server middleware on your website. The lightweight browser snippet can detect and alert, but a browser script cannot block a visitor.

A small business site has an admin login at /login. One evening a single IP address requests that page dozens of times within a few minutes.

Rakshak raises a high-severity brute-force alert with the IP address and the time. The owner sees it on Telegram, checks the activity and blocks the address on the IP management page.

The owner also turns on two-factor authentication and adds a limit on login attempts, because a patient attacker could come back from another address.

POST /login   (repeated many times within a few minutes from one IP address)

Will Rakshak lock users out of their accounts?

No. Rakshak does not touch your login system. It alerts you about suspicious activity around login URLs, and you can block an IP address if you decide to.

Why does Rakshak not block brute-force attempts automatically?

Repeated requests to a login page can also come from real people, from shared office networks, or from your own testing. An alert lets you decide, which avoids locking out genuine users.

What is credential stuffing?

It is a brute-force variant that uses real email and password pairs leaked from other sites. It succeeds when people reuse passwords, which is why unique passwords and two-factor authentication matter.

Is two-factor authentication enough?

It is one of the strongest defences, because a guessed password alone no longer works. Combine it with attempt limits and long passwords.

Does Rakshak detect attacks on a login page that does not contain the word login?

No. Detection depends on the address containing login or signin. Use attempt limits in your own application as the main protection.