What is a Bot?
A Bot is simply the abbreviation of a “roBot.”

Bots are 1000x faster than humans.

If we make a simple calculation, assuming that a human can manually attack one website per hour by conducting various security tests on WordPress, and then we see that a bot can attack a new website every 30 seconds with hundreds of requests, we can understand how quickly it can happen.

A computer can execute several million requests (tests) per minute.

In short, your website is hacked by a Bot?!

What the bot does in slow motion:
translated from computer language to human terms

Requests for the WordPress version

1. Html generator?
2. Readme.html?
3. Version.php?
4. Plugin output?

Requests for active plugins

1. Directory listing wp-content: plugins
2. Output in HTML
3. Function request

And so on… Millions of requests per minute!

And this database of requests is kept up-to-date via, yes… another Bot.

What does the bot do after making the requests?

Once the Bot knows the WordPress version running on your server and the active plugins and theme, it compares this information with the database containing vulnerabilities for each plugin and theme.

This process takes people half an hour, but for the bot, it’s a matter of milliseconds. (Thank you, technology!)

Knowledge is power

When the Bot knows which plugins and themes are running on the WordPress version, it will use that information to exploit known vulnerabilities and inject code into the database and server.

Oh no! Code injections into the database and server? That sounds nasty!

Indeed, it is. The injections add data, including files that become active and send spam, or gather more information about users, or gain access to the server.

How do you protect against bots?

The bots know the standard plugins, the default WordPress version, and compare them.
So, if they no longer know which plugins you are using, which theme, and which WordPress version, the bots are left powerless!

Combine this with the right measures against bots:

1. Proper file permissions
2. Directories in unknown locations
3. Hidden directories
4. Corrections for injections via the browser
5. Corrections for files on the server
6. Blocking users and IP addresses (bots)

Then you can stop the Bots. They are just scripts that follow protocols! Break the habit, and a Bot won’t know what to do.

You don’t have to make these adjustments to your website manually; you have a bot for that 😉
A script, or more specifically, iThemes Security!

If there’s anything that gives you a headache, it’s the different passwords for each website.

To add an extra factor, all sites have their own rules regarding password security.

Some common requirements we see:

1. Using an uppercase letter (UppercaseLetters)
2. Combining letters and numbers (eaad 8934)
3. The password must contain symbols (*&$!)
4. The password must not exceed 9 characters
5. It must be longer than 11 characters…

Sigh…

Can you choose one password that is accepted on every website?

Having one password that works on all sites is not possible..
(And not safe, but that’s beside the point)

Why not?
Because there are many contradictions between sites, where one site requires more than 8 letters/numbers, and another site indicates an 8-character limit.

So, it is advisable to use 2-5 variations.

Creating a strong password

With the following tip, you can come up with a strong password:

A phrase, for example:
2ENORMEnijlpaarden!
✔ letters
✔ numbers
✔ uppercase letter
✔ special character
(You will remember this one after 4 weeks 😉

It is important that you can remember it yourself. This works best with phrases that make sense to you.

80&$&()JKL is not easy to remember!

But 33nZ1n is!

Note that spaces are not allowed in a password, and the password must contain at least 8-10 characters (numbers or letters), which is a requirement that works on most sites.

So, in summary

For most sites, you’re good with 8-11 characters/numbers/uppercase letters.

Combine these for a strong password.

Do not write it down online or in your email, just write it on an old-fashioned piece of paper and keep it in a safe!

But NOT like this!

1. No birthdates
2. No first or last names
3. No first name with 123 after it
4. Don’t use your name spelled backward
5. No aaa sss or qwerty123
6. No dictionary words!!
7. D0n’t r3pl4c3 l3tt3rs w1th numb3rs

Why not?

If your name, birthdate, or other info is in a profile, a hacking script will first use that information to generate and test your password.

Next, it will try standard keyboard combinations that many people use, such as qqq www -or- qwerty -or- 12345, etc.

Then, the script will use the dictionary from a txt file and try those words on a website to hack your account.

Finally, the script will replace your name with numbers.

How do you block a Brute Force attack?

You can block a Brute Force attack by using a security plugin that imposes a temporary or permanent block on the computer from which the attack originates after 5-10 failed login attempts. This block is based on the IP address. Initially, the block is temporary, but if the Brute Force attack continues, it may become a permanent ban.

Hiding the username

The security plugin we use immediately ensures that your username is not visible everywhere. This is a critical point as the username is the first key to a Brute Force attack.

Usernames are easier to determine than you might expect. For example, many users still use “Admin” as the username or have a username that is the same as the website’s name.

Hopefully, you don’t recognize yourself in these common mistakes. But even if you have a username that is as long as the dictionary, the usernames can be easily retrieved from the database, the author page, or the name above blog posts. There is even hacker software that can reveal usernames.

Think of it like the nameplate on your house – easy to read, but make sure they don’t get their hands on the password (the key)!

Hiding the login page

It’s important to prevent a Brute Force script from easily accessing your login page.

By default, every WordPress login page can be reached at:

• www.yourdomain.com/wp-admin
• www.yourdomain.com/wp-login.php

This is well-known information.

The Ithemes Security PRO NL plugin allows you to choose a new unique address. For example:
www.yourdomain.com/log-in-here

What does WordPress do against Brute Force attacks?

As Brute Force attacks are common, WordPress decided in 2015 that passwords should meet certain requirements:

1. They must be at least 8-10 characters long
2. They should include numbers, uppercase letters, and special characters
3. They cannot be the username or website name

In a Brute Force attack, each character or digit that makes the password longer exponentially increases the difficulty of cracking the password.

When are you most likely to face a Brute Force attack?

The only good news so far is that the better your website performs in search engines like Google, the more bots will find your website.

It means that your website is well-visible and being visited by users!

Prevention is better than waiting..

Brute Force attacks will always exist, so prevention is better than cure. If you act too late, your website may be filled with backdoors, leading to potential damage. Google doesn’t appreciate spammy websites and can even inform visitors with a red warning that your website is unsafe!