Presumably, if someone tries to brute force into your website's control panel at your web host's site - they will be throttled/locked-out etc.

But what about the web publishing logins (Web-Deploy, FTP, ...)? How do we prevent anyone brute forcing those? Is the only way to have a password that cannot practically be brute forced, or is there any other method that can be implemented for that?

This is exacerbated by the fact that the control panel login is often valid for web publishing as well, so an attacker can try the passwords on publishing, and if successful - have access to the control panel as well.


The question is about a website hosted on a shared web hosting service with quite limited control over the server. Is there anything that can be done by someone using the hosting service to counter a brute force attack?

  • Have a look at this answer – BadSkillz Jul 16 '15 at 18:40
  • @BadSkillz Thanks. By FTP I meant - over SSL. If not - the password is easily compromised of course. – ispiro Jul 16 '15 at 18:46

There are a number of ways of mitigating brute-force attacks, depending on the level of control and access you have to the systems in question.

At a firewall level, you may be able to do rate limiting to throttle the number of connections from a given IP address. Also some firewalls will have Intrusion Prevention System capabilities which could allow for brute-force attacks to be throttled or blocked.

At a system level similar principles can be applied. Software like Fail2Ban can be used to block brute-force password guessing attacks by blocking the source IP addresses of those attacks.

This kind of blocking isn't perfect against a determined attacker as they can switch IP addresses to get round it, but it will generally work fine for the less targeted attacks.

  • Thanks. But perhaps I wasn't clear enough in my question. I'm asking about using a shared web-hosting service and therefore have limited control over their server's setup. – ispiro Jul 16 '15 at 18:33
  • that was why I opened with the bit about it depending on the level of access. If you have no control over the server or firewall configuration and the service provider doesn't provide any features that could be used for this, it's hard to see what you could do (i.e. you have no access, you can't change the service) apart from have good passwords. – Rory McCune Jul 16 '15 at 18:40
  • 2
    Shared hosting is by default a risk in my opinion, not to mention the control panels. If you want full control and be able to secure your server as much as possible, I suggest to look into either a dedicated server or a VPS. This way you can control all your concerns regarding brute force attacks. – Jeroen Jul 16 '15 at 18:42
  • @Jeroen-ITNerdbox Thanks. (I assume you meant to post that as a comment to my question.) – ispiro Jul 16 '15 at 18:44
  • @ispiro: That's correct! – Jeroen Jul 16 '15 at 18:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.