WordPress brute force attack protection

LiteSpeed includes a built-in brute force protection system for WordPress that limits repeated login attempts. You can enable it in minutes by adding a single directive to your .htaccess file.

What is a brute force attack?

A brute force login attack works by repeatedly guessing a site's username and password until the attacker gains access to the WordPress backend. Because WordPress powers such a large proportion of the web, it is a frequent target for this type of attack.

How the protection works

LiteSpeed's WordPressProtect directive limits the number of login attempts made within a five-minute window. Once the limit is reached, the server takes the action you specify.

The full syntax is:

WordPressProtect [off|on|drop|deny|throttle,] <limit>

The <limit> value controls how many login attempts are allowed before the action triggers. The accepted values are:

The three available actions are:

• throttle - slow down further requests (default if no action is specified)
• drop - close the connection immediately with no response
• deny - reject the connection with a 403 Forbidden response

Examples:

# Drop the connection after 10 login attempts
WordPressProtect drop, 10

# Throttle the connection after 20 login attempts
WordPressProtect throttle, 20

# Take the default action after 12 login attempts
WordPressProtect 12

How to enable the WordPressProtect directive

You add the directive to the .htaccess file in the root of your WordPress installation. You can edit this file using File Manager in cPanel or an FTP client.

1. Open File Manager in cPanel and navigate to your WordPress root directory (usually public_html), or connect via FTP.
2. Locate the .htaccess file.
3. Open the file for editing.
4. Add the following block at the very beginning of the file:

<IfModule Litespeed>
    WordPressProtect throttle, 5
</IfModule>

5. Replace throttle with your preferred action (drop or deny if you prefer) and adjust the limit to a value between 5 and 1000.
6. Save the file.

The protection takes effect immediately - no server restart is needed.