What Is a Brute-Force Attack?

A brute-force attack is an automated attempt to guess a password by trying millions of combinations until one works. It uses no cleverness, only speed and volume, which is why long passwords and a login limit defeat it. Bots run these attacks around the clock against WordPress login pages and email accounts across the web.

How does a brute-force attack work?

A brute-force attack works by trying passwords one after another until it finds the right one. There is no trick, just a program testing combinations faster than any human could.

Cloudflare defines it as a trial-and-error method used to decode sensitive data (Cloudflare, accessed August 2026), with no intellectual strategy behind it.

The attacker points automated software at your login page. It submits guess after guess, often thousands per minute, until a password lets it in or a defense stops it.

Short, common, or reused passwords fall first. A long, unique password can take so long to guess that the attack is simply not worth running.

Brute force, dictionary, and credential stuffing

Not every guessing attack is the same. Three related methods trade blind guessing for smarter shortcuts.

A plain brute-force attack tries random combinations, working through characters until one fits. It is thorough but slow.

A dictionary attack narrows the work. It tries a prepared list of likely passwords first, such as common words and leaked favorites, instead of every possible combination.

Credential stuffing is smarter still. It takes real email-and-password pairs stolen from one breached site and tries them on others.

Attack	What it tries	Why it works
Brute force	Random character combinations	Short or simple passwords fall fast
Dictionary	A list of common, likely passwords	People pick predictable passwords
Credential stuffing	Real logins leaked from other breaches	People reuse the same password

Cloudflare notes that OWASP treats credential stuffing as a subset of brute force (Cloudflare, accessed August 2026). It is far more efficient, though, with many estimates putting its success rate around 0.1 percent. That sounds tiny, until you realize attackers try millions of stolen logins at once.

What are attackers usually after?

Attackers run these at scale because even a small hit rate pays. What they gain from one cracked login is worth the automated effort.

A cracked website login lets them deface your site, plant spam, or inject code that gets your domain flagged on a malware blacklist.

A cracked email login is worse, because it can reset the passwords for everything else. That is why a broken inbox often becomes a full account recovery job.

In our experience, most site emergencies come from outdated plugins, not clever hacks, and sites left without a care plan get hacked eventually.

How do you stop a brute-force attack?

You stop brute force by making each guess slower and each success rarer. A few layers together do this well.

Limit login attempts, so an address is locked out after a handful of wrong tries. This alone defeats most automated guessing.

Require two-factor authentication, so a correct password still is not enough to get in.

Use long, unique passwords, ideally from a password manager, so guessing and stuffing both fail.

Add a bot check such as reCAPTCHA on the login and any public form, the same defense that helps stop form spam.

Frequently asked questions

How do I know if my site is under a brute-force attack?

The clearest sign is a flood of failed login attempts in your logs, often from many different addresses at once. You might also see the site slow under the load, or receive lockout emails you did not trigger. A security plugin or your host can alert you. On WordPress, repeated hits on the wp-login.php page are the usual pattern.

Will a strong password alone stop brute force?

Mostly, yes, for the guessing itself. A long, unique password can be effectively impossible to brute-force in any useful time. It does not help, though, against credential stuffing, where the password is already known from another breach. That is why a strong, unique password plus two-factor authentication is the pairing that actually holds.

Does brute force only target passwords?

No. The same trial-and-error approach is used against anything with a limited set of values, such as PINs, encryption keys, and hidden web addresses. Login passwords are simply the most common target because they are the most valuable. The defense is the same everywhere: slow the guessing down and limit how many tries an attacker gets.

Is reCAPTCHA enough on its own?

No, but it helps as one layer. A bot check like reCAPTCHA stops much automated traffic before it reaches your login, which cuts the volume of guessing sharply. Determined attackers and stolen-credential attacks can still get through, so pair it with login limits and two-factor authentication. Layers, not any single tool, are what stop these attacks.

Can hosting protect me from brute force automatically?

Often partly, yes. Many managed hosts and security services rate-limit logins and block known bad addresses before traffic reaches your site. This is one reason a quality host matters. It is not complete, though, so you should still limit login attempts and use strong logins. Relying on the host alone leaves gaps a targeted attack can find.

Keeping automated attacks off your site

Storming Solutions builds and maintains websites for Malaysian businesses, and hardening the login is part of every handover and care plan. We limit login attempts, add bot checks, and set up strong, second-factor logins so brute-force and credential-stuffing bots run into a wall, not an open door.

Worried your login is exposed, or seeing strange failed-login activity? Ask on WhatsApp or read why websites get hacked, then talk to us about web development.