Brute-force is a method of guessing your password by trying combinations of letters, numbers, and symbols. Some brute-force attacks utilize dictionaries of commonly used passwords, words, etc. in order to speed up the process of guessing users passwords.
The first thing you need to do to protect yourself from such attacks is to choose an appropriate username and password. Try not to use common names for your username as admin, administrator, superuser. Regarding your password, try using as complicated one as possible and include numbers, special characters, uppercase, and lowercase letters. There are free generators that create long and strong passwords for you to use. If you have experience issues remembering long passwords, you can use password vaults like 1Password for example.
If you detect that someone has launched a brute-force attack against your site (such attacks generate a huge amount of fail login attempts in your log), you can block the attackers IP address from accessing your site completely. To do that, add the following line to your .htaccess file:
deny from 18.104.22.168
Replace 22.214.171.124 with the actual IP address of the attacker.
In addition, restrict the admin areas of your site only for your address. In case you use WordPress, that should be your wp-admin folder.
If you use Joomla! – protect the administrator directory. Actually, that’s a good practice and it’s good to do it even if there is no attack against your site. The actual .htaccess rules you need to place in those folders are:
deny from all allow from 126.96.36.199
Replace 188.8.131.52 with your IP address. To find out what is your IP, you can use one of the many sites providing that information like whatismyip.com for example.