Brute Force Attack Blocked: What to Do Next

When This Happens

You're checking your server logs — maybe because a site got slow, or a user said they couldn't log in. Then you see it: the same IP address trying 500 different passwords in 2 minutes. On a Linux server with SSH enabled, you'll see lines like Failed password for root from 192.168.1.100 repeated over and over. On a WordPress site, you'll see hundreds of 404s or login attempts hitting /wp-login.php. That's a brute force attack. Someone has found your login page and is trying to guess credentials.

Root Cause

The attacker is using a script or bot that cycles through common usernames (admin, root, user) and common passwords (password123, letmein, 123456). They don't care about you personally — they scan the whole internet for vulnerable servers. The real problem? Your server is letting them try unlimited times. No lockout, no delay. If they try enough combos, they'll eventually hit a weak password. The fix is to block repeated failures at the firewall level, not just app level.

Step-by-Step Fix

Step 1: Find the Attacking IP

First, you need to see who's hitting you. Run this on your Linux server (or ask your hosting provider to run it):

grep 'Failed password' /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr | head -5

After you run that, you should see a list of IPs with a count of failed attempts. The top one is your attacker. Write that IP down — you'll need it in Step 3.

Step 2: Block the IP Temporarily (Immediate Fix)

You can block an IP instantly using iptables. This is a temporary block. It stops the attack right now:

sudo iptables -A INPUT -s 192.168.1.100 -j DROP

Replace 192.168.1.100 with the attacking IP you found in Step 1. After you run that, the attacker is blocked from all ports. Check if your site still loads for you — open a browser and visit your site. If it loads, you're good. If it doesn't, you blocked your own IP by mistake (happens more than you'd think). Double-check you entered the right IP.

Step 3: Install Fail2ban (Permanent Fix)

You don't want to manually block IPs forever. Fail2ban watches the logs and blocks IPs automatically after a set number of failures. Install it:

sudo apt-get install fail2ban   # Debian/Ubuntu
sudo yum install fail2ban       # RHEL/CentOS

After install, copy the default config:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Then edit the local file:

sudo nano /etc/fail2ban/jail.local

Find the [sshd] section. Make sure it looks like this:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 5
bantime = 3600

That means: after 5 failed SSH attempts, the IP is banned for 1 hour. Save the file, then restart Fail2ban:

sudo systemctl restart fail2ban

Check it's working:

sudo fail2ban-client status sshd

You should see a list of banned IPs. If you see your attacker's IP there, it worked.

Step 4: Protect Your Web Login (WordPress or Other)

If the attack was on your website login, not SSH, you need extra protection. Don't rely on plugins alone — they can slow down your site. The real fix is to limit login attempts at the server level. If you're using Apache, add this to your .htaccess file in the site root:

# Limit login attempts for wp-login.php
<Files wp-login.php>
Order allow,deny
Allow from all
Deny from 192.168.1.100
</Files>

Replace the IP with the attacker's. That blocks that IP from hitting wp-login.php. Then install a plugin like Limit Login Attempts Reloaded to auto-block after 3 failed tries. After installing, go to Settings > Limit Login Attempts and set "Allowed Retries" to 3 and "Lockout Time" to 3600 seconds (1 hour).

Step 5: Change Weak Passwords

If the attacker got in, you need to change passwords immediately. Not just the user that was attacked — change all admin passwords. Use a password manager to generate a 20-character random string. I like Bitwarden or KeePass. Don't reuse passwords across accounts.

If It Still Fails

Sometimes the attack keeps coming from different IPs (a distributed brute force). If that happens, the attacker is rotating through a botnet. Individual IP blocks won't work. You'll need to:

• Disable root SSH login. Edit /etc/ssh/sshd_config, set PermitRootLogin no, then restart SSH with sudo systemctl restart sshd.
• Change the SSH port. In the same file, change Port 22 to something like Port 2222. Then update your firewall to allow the new port.
• Use a Web Application Firewall (WAF). Cloudflare's free plan can block brute force attacks before they hit your server. Add your site to Cloudflare, enable "Under Attack" mode when you're getting hammered.
• Check if your server was already compromised. Run sudo lastb to see failed logins, and sudo last to see successful ones. If you see a login from an unknown IP at 3 AM, your server might have a backdoor. In that case, wipe and rebuild from backup.

One last thing: don't panic. Brute force attacks are normal — scanners hit every server on the internet daily. The fix is straightforward once you know what to look for. You've already stopped the bleeding. Now lock it down for good.