Can the software ModSecurity defend from Brute Force Attacks on PHPmyadmin and WordPress as well?
A particular hosting company providing shared hosting told me that ModSecurity should cover PHPmyadmin and WordPress as well as their Admin area and Cpanel area.
Does it sound plausible to you?
mod_security sits in the Apache webserver to offer some level of security for applications hosted on that webserver. Assuming you're talking about shared hosting (as opposed to dedicated or VPS providers), there's no reason their mod_security installation wouldn't be able to protect against attacks against any application installed on their webserver.
That being said, mod_security is highly configurable, so you'd need to check that there's brute force protection for the login pages you care about, and you'll also want to check if mod_security is even enabled for those paths.
Also note that some mod_security rulesets (those looking for SQL injection) are likely to have a very high false positive rate on PHPmyadmin, as they'll look for strings similar to the SQL queries legitimate users might enter into PHPmyadmin.
cPanel already uses modsecurity with OWASP CRS that will do all you are asking and more, if is your own cooking then just add ModSecurity with OWASP CRS v3.0 or later as previous may have lot's of false positives and CRS 3.0 and later already have WP exceptions available and paranoia level 1 to reduce false positives.
