So ... Here's the thing ...

The most common trick: hackers may try to break into your Wordpress site by guessing your admin password.

And right now I won't waste your time with boring technicalities about so-called brute force attacks, password-guessing scripts, etc.

But here's a heavily overlooked fact: by default, Wordpress allows users to try different passwords as many times as they want!!

Basically, this is the so-called brute force attack.

It means that I can try hundreds or thousands of passwords all day long, till I get access to your Wordpress admin area.

Or I could use a handy software that will do all the heavy lifting, testing 100s of thousands of words, phrases, etc until your website cracks.

I'll give you one example ... One of my sites (hosted outside of WA) recorded 269 failed login attempts in the last 30 days ...

The solution? Luckily, is pretty simple ...

You need to limit the number of failed login attempts per user.

For example: you can say after 3 failed attempts, lock the user out temporarily. In other words: if someone has more than 3 failed login attempts, then your site will block the given IP for a temporary period of time based on your settings. You can make it 5 minutes, 15 minutes, 24 hours, and even longer.

OK. Let's move forward to the next lesson to see how it works ...