How can I tell that I’m under attack?

The first thing many people notice when their site is under attack is poor site performance, passwords that no longer work, and/or unexplained redirects to unfamiliar websites.

An easy way to check if the attack is legitimate is to copy the IP address from the lockout notification, and go to https://whatismyipaddress.com/ip-lookup. Enter in the IP address to see if you recognize the location. If the location is not somewhere you recognize, then you are probably under an attack.

What are the consequences if an attack is successful?

Successful attacks typically result in a malware infection within your website’s files. This infection can be experienced either gradually or immediately through poor website performance and unexplained functionality like redirects, popups, and unresponsive menus. At its most severe, a successful attack can cause the complete destruction of an online business or brand. Here are some of the most damaging consequences of a brute force attack:

• Collecting sensitive info from website users and customers including login credentials, financial information, and other info used to conduct identify theft.
• Redirecting users without your knowledge to illicit or spammy websites.
• Holding your site ransom for a disclosed fee (also known as „ransomware attacks“).

Will this plugin help with my website speed and performance?

If your website speed and performance is being hindered by an influx of malicious login attempts, then this plugin will help improve speed and performance. By setting a max number of lockout retries, the plugin restricts bots from overwhelming your server with illegitimate login attempts. Key premium features like throttling, outsourced site load, synced lockouts, and cloud storage can further improve speed and performance negatively affected by brute force attacks.

What did I do to expose myself to an attack?

Brute force attacks happen constantly to sites worldwide. If an attack is successful, it may or may not be your fault. Most attacks are successful because of either an easy-to-guess password („password“ or „pass123“), or user credentials that were compromised through a data breach.

Don’t be too hard on yourself if your site is hacked. Even with the strongest username and password, complex bots can „guess“ login credentials in a matter of seconds.

How do I better protect from brute force attacks in WordPress?

Using strong passwords that are not used anywhere else is important for preventing brute force attacks, as is removing user accounts that are no longer valid. Unfortunately, even the strongest passwords can be cracked by intricately designed bots that can calculate thousands to billions of username/password combinations in seconds. Your going to receive the best protection with your WordPress site is by upgrading to the premium version of the Limit Login Attempts Reloaded plugin.

How customizable is this plugin?

The free version of Limit Login Attempts Reloaded allows you to limit lockouts and receive notifications of an attack. You can also deny/allow IP addresses, control the # of lockout attempts. If you are looking for the best protection, you’ll want to add our advanced features like throttling, outsourcing site load, and synced lock outs.

Can I install this plugin on more than one site?

We encourage all of our plugin users to install Limit Login Attempts Reloaded on every WordPress site they own or operate. Users with more than one site should consider the premium or enterprise version of the plugin which offers enhanced security and performance across a network of websites.