What It Is
In a brute-force attack, software tries thousands of password guesses against a login page, one after another. It is like a burglar with a giant ring of keys trying each one in your front door. Attackers often start with common passwords and ones leaked from other websites. WordPress login pages are frequent targets because their address is predictable on most sites.
Why It Matters for Your Business
If an attacker guesses an administrator password, they control your whole website. They can add malware, change your phone number, or lock you out entirely. Even failed attempts cause harm, since a flood of login requests can slow a small site down. A dental office might notice its website crawling every evening without realizing bots are hammering the login page.
Good to Know
Use a long, unique password for every admin account, stored in a password manager, and turn on two-factor authentication. Limit login attempts so an address gets temporarily blocked after several failures. Remove old user accounts for past employees or contractors. Avoid using "admin" as a username, since it is the first name attackers try.