Hardening Reference
Brute force attack — Why a login flood shows up first as a speed complaint
The site got slower on Thursday, nothing was deployed, and the access log is almost entirely one URL.
The short answer
A brute-force attack is automated credential guessing — password lists, leaked pairs replayed, or a few obvious passwords sprayed thinly across many accounts — run continuously by machines with no interest in who you are.
The part most write-ups miss is the bill. Every POST to a login form is uncacheable by definition, so each attempt boots PHP, opens the database and occupies a worker. Long before anyone guesses a password, you are paying for the attempt in response time.
By the HostingFast team · Reviewed 24 August 2026
0
Hand-waving in this entry
100+
Entries wired to each other
Real
Numbers you can reproduce
Free
To read, no gate
The variants have names worth knowing because they behave differently in a log. Straight guessing hammers one account with many passwords. Credential stuffing replays real pairs from breach dumps, so the attempt rate is lower and the success rate is far higher. Password spraying tries three common passwords across a thousand usernames, deliberately staying under any lockout threshold you have set.
The defences stack, and they stack cheaply. A unique long password ends guessing outright. A second factor makes a correct guess useless. Rate limiting at the web server thins the traffic before PHP is involved. Key-only SSH ends the contest on that port entirely rather than merely slowing it down.
It costs workers before it costs an account
A cached page is served by LiteSpeed without waking PHP at all. A POST to wp-login.php cannot be cached, so every one of them takes a worker from the same small pool your real visitors are queueing for. Three hundred attempts a minute against a login form is a small denial-of-service attack that nobody set out to launch.
This is why the first complaint is usually about speed. The site is not compromised, it is busy — busy doing unpaid work for a botnet, at the expense of the people trying to check out.
Counting it in the access log
One pass over the log answers it. Filter to the login path, count by minute, then count by source address. A handful of attempts spread over hours is background noise; hundreds a minute from a wide address range is the thing you came looking for. Do the same for xmlrpc.php, which is the quieter route into the same problem on WordPress.
For SSH, the equivalent is the failed-login record and the authentication log. Thousands of failures overnight against root and admin is entirely normal for any machine with a public address, and it is only interesting if password authentication is still enabled.
Stop the request, not just the login
A login-limiting plugin refuses the attempt after PHP has already booted, which fixes the security half and none of the performance half. Blocking at the web server or the network edge is what actually recovers your workers, because the request dies before the application is involved.
fail2ban does the same job on a VPS by reading the log and adding short-lived firewall rules. Pair it with a jail for the web login path as well as for SSH; the default configuration usually only covers the second.
End the contest where you can
On SSH there is a clean answer: keys only, password authentication disabled. After that the attempts continue and every one of them is arithmetic that never terminates. That is a better outcome than any rate limit, because it removes the possibility rather than reducing the frequency.
On the web login you cannot go that far, so aim for a second factor plus edge rate limiting. Neighbouring entries: Two-Factor Authentication, Firewall, SSH and Malware. Edge filtering is standard on plans here, so the volumetric end of this is already handled.
Where security and performance turn out to be one subject
Half the security entries in this reference are also performance entries, because unwanted traffic costs the same resources wanted traffic does. We write them that way because that is how they turn up in a ticket.
Edge filtering, NVMe storage and LiteSpeed caching are standard on every tier, so the volumetric half of this is handled before it reaches your account.
- Security and speed treated as one
- Log commands, not reassurance
- Terms linked in the order you meet them
- Written by the engineers on call
Why HostingFast
Standard on every plan
The cost, stated first
Every login attempt is uncacheable, so it wakes PHP and takes a worker. That is the bill you are already paying.
Three variants told apart
Guessing, stuffing and spraying leave different fingerprints in a log and need different answers.
One pass over the log
Count by minute, then by source, on the login path and on xmlrpc.php. That is the whole diagnosis.
Block early, not late
A plugin refusing the attempt after PHP boots recovers no capacity at all. The edge does.
SSH solved outright
Keys only, passwords off, and the attempts become arithmetic that never terminates.
Wired to its neighbours
Two-Factor Authentication, Firewall and SSH are the entries that complete this one.
Quick Start
From order to online
- 1
Count before you configure
Filter the access log to the login path, count by minute and by source. Ten minutes of counting beats an afternoon of installing plugins.
- 2
Move the block earlier
Rate limit at the web server or the edge so the request never reaches PHP. That is where the capacity comes back.
- 3
Take SSH out of the contest
Keys only, password authentication disabled, then leave the log alone. Failed attempts against a key-only port cost nothing worth reading.
Built In
Loaded onto every plan
- DDoS filtering absorbed out at the network edge
- Free SSL on every plan, renewed automatically before it can expire
- Spam and virus screening on every mailbox as standard
- SSH, Git and Composer on the developer-focused plans
- WordPress and 400+ other applications installed in one click
- Softaculous on board for one-click application installs
- Email addresses that run on your own domain name
- A renewal price identical to the price you signed up at
- Zero setup charges — there is no joining fee, ever
- Money-back cover: 30 days on hosting plans, 7 on reseller
Frequently Asked
What people ask us most often
How do I count login attempts in my own access log?
Filter to the login path, group the entries by minute, then group them again by source address. Two numbers come out: the attempt rate and how widely it is spread. A steady rate from thousands of addresses is a distributed attempt; a burst from a handful is a script somebody pointed at you. Run the same two counts against xmlrpc.php, which carries the quieter version of the same traffic.
Does a login-limiting plugin fix the slowdown?
Only partly. It refuses the attempt, which is the security half, but PHP has already booted and the worker has already been taken by the time it runs. To get the capacity back the request has to be refused before the application is invoked — at the web server, or at the network edge. Run both if you like, but do not expect the plugin to move your response times.
Is moving SSH off port 22 worth doing?
It cuts log noise and nothing else. Scanners find the new port within a day. The change that matters is key-only authentication with passwords disabled, after which the attempts are irrelevant regardless of which port they arrive on. Do the second one first; treat the port change as tidying.
What if a rate limit locks me out of my own site?
You get back in through the panel, or by allow-listing your own address, or by waiting the window out. The asymmetry is the point: a few minutes of inconvenience for you against arithmetic that never finishes for someone with a million guesses to spend. Support can lift a block immediately if you are stuck, at any hour.
Keep reading
SSH (Secure Shell)
Key-based access to the command line, and why password authentication should be off.
Two-Factor Authentication (2FA)
Second factors ranked by what they actually resist, and the order to enable them in.
How to Force HTTPS on Your Site
Forcing every request onto TLS properly, without stacking three redirects to do it.
Dedicated Cloud
Reserved resources with cloud flexibility, a step up from a single virtual server.
Domain Names
Find, register and transfer names, with the first year free alongside annual hosting.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Stop paying for other people's guesses.
Edge filtering on every tier, LiteSpeed caching in front of PHP, and support that reads a log with you.
View Dedicated Cloud plans