0

Brute force attacks seem to the be most common vulnerability on WP installs and rate limiting ought to be relatively easy to bake into WP itself as part of the official, default software (without the need to install a plugin). Why isn't this basic security feature included by default?

1
  • WordPress provide good security out of the box. It's not WordPress is the main problem in most cases but mostly users and their servers are. People tend to use easy passwords and use cheap unsecured servers. Also the feature you are asking is not implemented in almost any of popular CMS or systems by default. That's why it's a plugin. Although I never really felt the need to use such plugins if you use strong password. Because mostly hackers do not crack password but take advantage of venerability in your outdated code/plugin/theme/addon or venerability on servers. – Robert hue Nov 20 '14 at 8:52
2

Brute force attacks seem to the be most common vulnerability on WP installs

  1. Brute force attacks are not WordPress vulnerability. They are password vulnerability, if bad passwords are used.
  2. They are common, but if they are "the most common" in occurrences and, more importantly, breaches is questionable.

rate limiting ought to be relatively easy to bake into WP itself

Had you tried to bake this easy thing? :)

I am yet to see login "security" plugin that didn't cause login issues long term, clashed with less than mainstream browsers, clashed with password manager applications, and so on. Ok, maybe there is one I can think of — for Google 2FA.

Anyone yet to demonstrate that easy thing can be done reliably in plugin. Doing it at core scale? Ugh.

Why isn't this basic security feature included by default?

So there you have it:

  1. It's not basic.
  2. It's not easy to implement.
  3. It works just fine without it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.