Somebody is trying to brute force the password Looking at the site log, I found, that somebody with IP address: 91.236.74.135 is methodically sending requests to the page: /user?destination=node/add of my Drupal website. He does it once in every hour. It's definitely a bot. I think, he's trying to brute force the password. For now I banned him in .htaccess with

deny from 91.236.74.135


Can anybody give an advice, how to protect the site from brute force attacks on logins?
I have two ideas to help with this problem.

There are tools and services you can use to look for brute force attacks. The security review module and droptor tools both look in your watchdog (at Administer > Reports > Recent log messages) to see if you have a lot of failed logins for one user. You can also do that manually.

In Drupal 7 the "access rules" feature was removed from core but moved to a contributed module - User Restrictions. Using that module you can block users from a specific IP address. Apache deny rules will be slightly faster if you have relatively small number of rules but the Drupal rules are easier to add/update/remove.