A brute force attack is when an automated bot tries thousands of username and password combinations on your login page, hoping to guess its way in. It's one of the most common ways WordPress sites get hacked.
Also known as: Login attack, credential stuffing, password guessing
In plain English
Bots constantly hammer WordPress login pages with guessed usernames and passwords - "admin" plus every password in a leaked database, thousands of times a day. It's automated, relentless, and costs the attacker nothing to run.
Why it matters for your business
If any account uses a weak or previously-leaked password, brute force is how it gets found. Once inside, attackers install malware, create hidden admin accounts, or use your site to attack others - which can get your hosting suspended.
When you'll run into it
Constantly, on every WordPress site. You'll see it in security logs as repeated failed logins; the defense is strong passwords, limited login attempts, and two-factor authentication.
Run into this on your site?
WordPress Care Plans