How to prevent brute force attacks
Brute force protection stops automated guessing before it reaches your password check. Put a bot check on your login, password reset and OTP forms and have your server verify it on every attempt, add rate limits per account and IP address, and require MFA so that a guessed password alone does not open an account. Monitoring and checks against breached passwords then catch what still gets through.
No single measure stops every kind of brute force attack. What holds up over time is several layers together:
- Strong password rules: length, unique passwords and a list of banned passwords
- A CAPTCHA on login and reset forms that stops automated attempts
- Multi-factor authentication (MFA), so a guessed password alone is not enough to take over an account
- Monitoring and alerts for unusual activity on authentication endpoints
- Rate limiting that slows down high-frequency attempts
The CAPTCHA goes after the attacker’s biggest advantage, which is automation. Without automation, brute force becomes slow, inefficient and expensive. It also saves you work further down the line: fewer security incidents around logins, fewer password resets triggered by bots and less load on your identity systems.
What brute force attacks are and what they target
A brute force attack is trial and error at machine speed: automated tools guess login credentials, encryption keys or access tokens until one works. Brute force protection is everything that makes this guessing slow, expensive and easy to see, from rate limits and a bot check on every login to MFA and monitoring. The attacks still succeed surprisingly often, mostly against organizations whose logins, APIs and admin panels are exposed and protected unevenly.
Brute force rarely shows up as one obvious incident. It is usually steady pressure: scripted guesses, credential stuffing with passwords from data breaches, and botnets that spread the attempts over so many IP addresses that simple IP blocks miss them. So the goal is not to block one attacker. It is to take away the attacker’s ability to automate login attempts anywhere in your environment, without making life harder for real users or flooding your support desk with locked accounts.
The usual targets are login forms and authentication endpoints, admin dashboards and CMS panels, API authentication, VPN and remote access gateways, and the endpoints for password resets and OTP codes. Any of them can be hit, especially if it accepts unlimited requests, or if your website, mobile app and API are protected differently. Leaked passwords, cheap botnets and AI-driven bots have made brute force faster and cheaper to run, and harder to spot. The sections below cover the attack types, how to recognize an attack and what to do during one.
Types of brute force attacks and how to block each one
Brute force is not one technique. Attackers pick a method based on what they know, what they have stolen and which defenses they expect. The table lists the common variants and the countermeasures that work best against each.
| Attack type | How it works | What attackers need | Typical targets | Impact | Most effective countermeasures |
|---|---|---|---|---|---|
| Classic brute force | Tries a large number of passwords automatically until one matches | Nothing | Login forms, admin panels | Breaks weak passwords; puts heavy load on the login | Strong password policy, rate limiting, CAPTCHA, lockout thresholds |
| Dictionary guessing | Uses lists of common passwords (often leaked “top passwords”) | A password list; sometimes known usernames | Consumer logins, CMS, SaaS portals | Quickly breaks predictable passwords | Strong password rules, banned password lists, CAPTCHA, MFA |
| Hybrid guessing | Combines dictionary words with patterns such as years or special characters | Word lists and common patterns | Enterprise portals, SSO login pages | Beats “fairly strong” passwords that people make up | Password managers, random passphrases, CAPTCHA, MFA |
| Password spraying | Tries a few popular passwords across many accounts to avoid lockouts | A list of usernames | SSO, email, company apps | Slow but scalable; breaks into several accounts | CAPTCHA, MFA, anomaly detection, throttling per account and per IP |
| Credential stuffing | Reuses username and password pairs from data breaches on other sites | Credential dumps from breaches | Online shops, any login | High success rate when users reuse passwords | CAPTCHA, MFA, breached-password checks |
| Reverse brute force | Tries one known password against many usernames (e.g., “Welcome123!”) | A likely password | Employee portals, legacy systems | Can break into several accounts quickly | CAPTCHA, MFA, password hygiene, monitoring |
| Distributed brute force (botnets) | Spreads attempts across many IP addresses and devices to get past IP blocks | Botnet capacity | High-value targets | Gets past simple IP blocking; keeps up the pressure | Proof-of-work CAPTCHA (TrustCaptcha), behavioral scoring, adaptive throttling |
| Session and token guessing | Guesses weak tokens, session IDs or API keys | Knowledge of token formats or weak randomness | APIs, session endpoints | Account takeover without a password | Strong token generation, rotation, rate limiting, CAPTCHA, short token lifetime |
| Password reset abuse | Attacks reset flows to find valid accounts or guess OTP codes | Access to the endpoint; sometimes leaked email addresses | Reset and OTP verification endpoints | Account enumeration, takeover attempts, support overload | CAPTCHA, rate limits, stronger OTP handling, error messages that do not reveal accounts |
Signs of a brute force attack
Failed logins happen every day. A brute force attack looks different, because the pattern points to a script rather than to people mistyping their password.
To spot a brute force attempt, look for patterns like these:
- A spike in logins concentrated on a small set of accounts, most of them failing.
- Attempts on many different accounts with the same password.
- Repeated login requests from rotating IP addresses or from countries your users are not in.
What to do if you suspect a brute force attack
When an attack is running, speed matters. The aim is to take away the attacker’s automation quickly without locking out so many accounts that your own business grinds to a halt.
Do this first:
- Put a CAPTCHA on the attacked endpoint right away to stop the automation.
- Throttle requests on the login, reset and OTP endpoints, per IP address and per user.
- Turn on MFA, or require an extra verification step, for high-risk logins.
- If needed, lock the targeted accounts for a while or ask them for an extra step.
- Force a password reset on accounts that show signs of compromise.
- Check logs and alerts for successful logins from suspicious locations or devices.
How CAPTCHAs help stop brute force attacks
A modern CAPTCHA adds a check before your application accepts a login request, and that check is hard to automate. In practice it helps in several ways:
- Bots can no longer submit the login form over and over at high speed.
- Tools that cycle through password lists and credential dumps stop running smoothly.
- Login attempts that rely on identical, repeatable requests break.
- Every attempt costs the attacker extra work, which slows them down.
- It works against bursts as well as “low and slow” attacks that try to stay below detection thresholds.
Combined with MFA and monitoring, a CAPTCHA makes brute force inefficient and much easier to contain, without blunt measures such as mass lockouts that hit real users.
TrustCaptcha for brute force protection
TrustCaptcha is a CAPTCHA for organizations that need strong security without giving up privacy, accessibility or conversion. It runs in the background without a puzzle and is built for the places brute force goes after: login, password reset and verification endpoints. For Keycloak brute force protection and brute force protection for WordPress, ready-made plugins add it to the login form without custom code.
How TrustCaptcha prevents brute force attacks: proof-of-work and bot score
TrustCaptcha uses two mechanisms against automated guessing and distributed bot traffic.
Proof-of-work
With proof-of-work, the browser has to solve a small computational task for every request. For a real user, this takes a moment and happens out of sight. For bots working at scale, it changes the math:
- Every attempt costs computing power.
- High-volume attacks get slower.
- A botnet pays for every request, however many IP addresses it uses.
- Cheap guessing turns into expensive, throttled guessing.
The cost grows with the amount of abuse, while normal users are not blocked. That matters most on busy sites, where lockouts and IP blocks alone would hit too many real people.
Bot score
From the Solo plan, TrustCaptcha also gives each request a bot score based on its technical context and behavior, where 0 means human. Your server can then treat traffic by risk:
- Low-risk traffic passes without delay.
- Suspicious requests get harder work, which costs attackers more time and money.
- Clear automation gets slowed down or blocked.
This helps most when attackers rotate IP addresses, imitate browsers and try to blend in with real traffic. Instead of brittle allow and block rules, TrustCaptcha adjusts to the risk of each request, so you get stronger security while conversion and accessibility stay high.
Try TrustCaptcha
Brute force attacks are almost always automated and aimed at the endpoints every application needs: login, password reset, OTP and API authentication. A CAPTCHA is still one of the most effective ways to stop them at the source, so protect those endpoints first, and if an attacker does get into an account, our guide to account takeover protection covers what comes next.
Every plan starts with a 14-day free trial, and non-commercial websites can use TrustCaptcha for free. Start your free trial and see how it works on your own login form.
