I use Ubuntu 16.04 Nginx environment and SSHguard to prevent Brute Force Attacks (BFAs) on the machine VPS environment itself but I'm not sure how I could prevent BFAs on WordPress without using a plugin.

Unlike Drupal that has an application layer BFA prevention mechanism, WordPress has none.

What is the most minimal way, without a "complex" plugin like WordFence, to prevent BFAs in WordPress admin?

The end state should be that IPs trying to enter more than x times get blocked for at least x time (presumably, the default values).

Edit: Maybe SSHguard could help with that too?

  • Why do you not want to use a plugin?
    – janh
    Jan 5 '18 at 8:14
  • Many popular plugins tend to be snoozy / ticky, embedded with aggressive pro version marketing. Besides I usually prefer to be dependent in less modules as possible. Jan 5 '18 at 8:47
  • If this is how drupal works, no wonder wordpress is used more.... Anyway, what stopping you from implementing your algo by yourself? Jan 17 '18 at 16:05
  • I don't have enough knowledge in iptables, IPS architecture and regex to create such algorithm. I only know some basic regex (about this . ? () [] {} ^ $ * | \ \w \s \K) and I'm very new to PHP so I don't really know where to start with this. Jan 17 '18 at 16:18
  • 1
    Thanks, much clearer now! Personally I don't really know SSHguard, but this article seems to cover setting it up to track WordPress login attempts, which I guess is enough 90% of the time.
    – swissspidy
    Jan 21 '18 at 22:43

One plugin-free layer of protection you could implement is to route your traffic through a site like CloudFlare that has built in brute force protection. The free version is a great layer of protection with paid tiers if you need the added features. I have used this for several of my sites.

I am with you in that I try to use as few plugins as necessary.

*note: felt this would have been better as a comment but did not have the necessary reputation.*

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.