How to protect against brute-force attacks

Quick answer: Remove the passwords bots guess: use SSH keys and disable password logins, add Fail2ban to ban repeat offenders, rate-limit login endpoints, enable 2FA where panels support it, and don't expose admin interfaces to the whole internet. Brute force only works when unlimited cheap guesses are possible — take that away.

Overview

Brute-force attacks try large numbers of username/password combinations against anything that authenticates: SSH, control panels, WordPress logins, mail and FTP. Single mitigations help; layered ones (strong or no passwords + bans + rate limits + 2FA) make the attack economically pointless.

Before you start

• An inventory of every login surface on your server: ss -tlnp shows listening services.
• Root/sudo access to configure services and the firewall.

Step-by-step guide

1. SSH: keys only, no root login (secure SSH access), plus Fail2ban. UFW can also rate-limit: ufw limit ssh.
2. Web logins: rate-limit at the web server, e.g. Nginx:

   limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;
   location = /wp-login.php { limit_req zone=login burst=3 nodelay; }

3. WordPress: follow the dedicated brute-force guide — login limits, 2FA, xmlrpc restrictions.
4. Control panels: enable their built-in 2FA and IP access lists; don't leave panel ports open to 0.0.0.0/0 if you can restrict them.
5. Everything else: disable services you don't use; a port that isn't open can't be brute-forced (firewall guide).
6. Watch the logs so you notice campaigns early (how to read auth logs).

Common issues

• Legitimate users get banned: loosen maxretry/findtime or whitelist office IPs in ignoreip.
• Attack keeps coming from thousands of IPs: that is closer to credential-stuffing/DDoS — rate limits and 2FA still hold; see what is a DDoS attack.
• 2FA fatigue: use app-based codes or keys, not SMS, and only on the accounts that matter — admin ones.

When to contact support

If login floods saturate the server despite bans and rate limits, or you suspect an account was actually breached, open a support ticket — include timestamps and log excerpts (reporting guide).

Frequently asked questions

What is a brute-force attack?

An automated campaign that tries large numbers of username and password combinations against SSH, control panels or website logins until one works or the attacker gives up.

Which defense stops brute force most reliably?

Removing passwords from the equation: SSH keys with password authentication disabled cannot be guessed at all, and 2FA gives web logins the same property even if a password leaks.

Do rate limits hurt real users?

Configured with sensible thresholds and a burst allowance they are invisible to humans — a real user never sends five login attempts per second, but a bot does.

Related articles

• How to install Fail2ban
• How to protect WordPress from brute-force attacks
• How to secure SSH access
• How to protect an API or web app

Need a hand? Contact Cloud2Y support →