So, what can we do to protect out blogs from brute force attacks, where hackers just spend ages trying out every single password using clever pieces of software?

Actually, as I said yesterday although brute force will get in eventually, we stack the odds in our favour quite easily.

First of all, you must understand that these people work by just guessing different password strings. If you leave the administrator id as admin and use the password of ‘password’, then they will take seconds to guess those. Change just one of these and you make the job harder. Change both and it becomes many times harder.

If you have a secure password, for example using upper and lower case letters, numbers and an odd symbol or two, then the chance of someone trying that many different combinations is small.

If you also change the admin id and don’t make it obvious, then they not only have to hammer away at the password, but also at the userid. And that can be a double protection.

And there is also a third trick up our sleeves – admin lockdown plugins! These can be set to lockout login attempts from an IP address that has had too many failed attempts. For example, 3 failed attempts in 5 minutes and they are locked out for an hour. This means that hackers can only try two passwords in 5 minutes – 24 an hour. Brute force will take years at that rate!

Want to know how to do these or other security considerations? Come back again, or follow the blog security tag.

If you want to keep up with our latest posts, just follow us on our RSS feed, join our weekly newsletter or follow us over at Twitter. Please do join in - it is totally free and only the best posts are passed to you!

Also, leave a comment below. We are a 'DoFollow' blog, so it is well worth your time. Thanks for calling in.