Brute-force attack

Brute-force attack is an automated guessing game: bots try password after password (or PIN, or API key) until one works. admin / Password1, then Password2, then a dictionary of common words. Speed and volume are the weapons.

It is not credential stuffing. Stuffing replays emails and passwords stolen from other breaches. Brute force invents guesses. Both hammer /login or wp-admin. A WAF plus rate limiting slows the spray; CAPTCHA asks for a human; two-factor authentication makes a guessed password useless; passkeys remove the secret you can guess. HTTPS encrypts the trip; it does not stop a weak password.

A real-life example of a brute-force attack

A Midtown shop’s WordPress login sits at /wp-admin. Overnight, bots try admin with thousands of common passwords from a rented botnet. There is no leaked customer list involved — just noise against a door with a cheap lock. Rate-limit five tries a minute and the attack dies; leave it open and one lucky guess is an admin session.

Throttle logins, lock out repeats, force 2FA on staff. Tactics: Cloudflare against brute-force and credential stuffing and 5 rapid actions.