Brute Force Attacks Surge in 2020

Pirated Themes and Plugins have been the most common source of malware infections on WordPress websites in 2020 according to WordFence. 

When a website is built, and made live to the open world, it automatically becomes prone and vulnerable to attacks, threats and unwanted login attempts, it becomes your first priority to make sure you have used proper website security to protect your website and its important files from threats. 

WordPress websites have an equal chance of getting infected with malicious bugs and errors. WordPress themes and WordPress Plugins are heavily used while making a website. Users in order to get hands on the premium themes and plugins for their website for free try to use pirated plugins and themes.  

These Pirated plugins and themes creates a window for the hackers and attackers to do anything to your website with you even noticing it. You wouldn’t want that for yourself or for your website. The websites which have been using pirated plugins and themes have been under constant attack due to its breaches and problems. So it is highly advised to not download WordPress plugins and themes for your website from external and unreliable sources as it can have all sorts of potential difficulties and malicious problems.

There are nearly 70 million malicious files present on more than 1.2 million WordPress websites in 2020 which is detected by WordFence’s malware scanner. 

“Overall, the Wordfence scanner found malware originating from a nulled plugin or theme on 206,000 sites, accounting for over 17% of all infected sites,” the company said on Wednesday.

Of these 206,000 sites, 154,928 were infected with a version of the WP-VCD malware, a WordPress malware strain known for its use of pirated/nulled themes for distribution

Pirated themes and plugins have also been a reason for attacks and numerous WordPress websites got infected with malware via pirated themes and plugins. Some other methods by which the websites have been hacked includes brute force attacks against login forms and exploit codes that take advantage of unpatched vulnerabilities.

2020, The Year of Brute Force Attacks

Wordfence has reported that there have been more than 90 billion malicious & automated login attempts coming from more than 57 million different IP addresses, the attacks were most likely a part of attack botnets and proxy networks with 2.8K malicious login attempts/per second against users. 

One such way to minimize these attacks is to deploy a WAF or enable a two-factor authentication solution for their accounts. 

In 2020 alone, more than 4.3 billion attempts were made to exploit WordPress websites which is a huge number according to WordFence. 

Directory Transversals being the most common type of threats exploited by the attackers in 2020 is a type of bug that tries to read files from WordPress installations (Like wp-config.php) or upload malicious files on WordPress websites. 

Some other attempts are SQL injection, cross-site scripting issues, remote code execution bugs or even authentication bypasses. 

Turns out, there is a massive 43% directory transversal attack, followed by SQLi attack which is 21%. The other attacks include XSS types and malicious file uploading. Rest 14% attacks are all other different types of attacks. 

Final Thoughts

With increasing attacks and data breaches, you have to take care of your WordPress website by having security plugins on your website as well as following all the security standards with necessary changes and patience that can help your website be protected by external attacks. Pirating plugins and themes can be a very bad idea since it can make your website vulnerable to the highest risk and ruin your everything. 

Our Essential Plugin Bundle comes with 10+ WordPress Security features which can help you secure your WordPress website in a smart and efficient way.

With our 10+ best basic WordPress Security like Two Factor Verification, your website will be secure enough o avoid all those brute force attacks which take place on websites.