Presumably, if someone tries to brute force into your website's control panel at your web host's site - they will be throttled/locked-out etc.

But what about the web publishing logins (Web-Deploy, FTP, ...)? How do we prevent anyone brute forcing those? Is the only way to have a password that cannot practically be brute forced, or is there any other method that can be implemented for that?

This is exacerbated by the fact that the control panel login is often valid for web publishing as well, so an attacker can try the passwords on publishing, and if successful - have access to the control panel as well.


The question is about a website hosted on a shared web hosting service with quite limited control over the server. Is there anything that can be done by someone using the hosting service to counter a brute force attack?

  • Have a look at this answer
    – BadSkillz
    Jul 16, 2015 at 18:40
  • @BadSkillz Thanks. By FTP I meant - over SSL. If not - the password is easily compromised of course.
    – ispiro
    Jul 16, 2015 at 18:46

1 Answer 1


There are a number of ways of mitigating brute-force attacks, depending on the level of control and access you have to the systems in question.

At a firewall level, you may be able to do rate limiting to throttle the number of connections from a given IP address. Also some firewalls will have Intrusion Prevention System capabilities which could allow for brute-force attacks to be throttled or blocked.

At a system level similar principles can be applied. Software like Fail2Ban can be used to block brute-force password guessing attacks by blocking the source IP addresses of those attacks.

This kind of blocking isn't perfect against a determined attacker as they can switch IP addresses to get round it, but it will generally work fine for the less targeted attacks.

  • Thanks. But perhaps I wasn't clear enough in my question. I'm asking about using a shared web-hosting service and therefore have limited control over their server's setup.
    – ispiro
    Jul 16, 2015 at 18:33
  • that was why I opened with the bit about it depending on the level of access. If you have no control over the server or firewall configuration and the service provider doesn't provide any features that could be used for this, it's hard to see what you could do (i.e. you have no access, you can't change the service) apart from have good passwords. Jul 16, 2015 at 18:40
  • 2
    Shared hosting is by default a risk in my opinion, not to mention the control panels. If you want full control and be able to secure your server as much as possible, I suggest to look into either a dedicated server or a VPS. This way you can control all your concerns regarding brute force attacks.
    – Jeroen
    Jul 16, 2015 at 18:42
  • @Jeroen-ITNerdbox Thanks. (I assume you meant to post that as a comment to my question.)
    – ispiro
    Jul 16, 2015 at 18:44
  • @ispiro: That's correct!
    – Jeroen
    Jul 16, 2015 at 18:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .