{"id":496,"date":"2026-01-18T20:09:00","date_gmt":"2026-01-18T20:09:00","guid":{"rendered":"https:\/\/narhost.com\/blog\/?p=496"},"modified":"2026-10-07T20:49:41","modified_gmt":"2026-10-07T17:49:41","slug":"brute-force-nedir","status":"publish","type":"post","link":"https:\/\/narhost.com\/blog\/brute-force-nedir\/","title":{"rendered":"Brute Force Nedir ve Sunucunuzu Nas\u0131l Korursunuz"},"content":{"rendered":"<div id=\"ai-ozet\" class=\"ai-box\">\n<p class=\"ai-box-title\">K\u0131saca \u00f6zet<\/p>\n<ul>\n<li>Brute force nedir sorusunun k\u0131sa cevab\u0131: bir hesab\u0131n parolas\u0131n\u0131 deneme yan\u0131lma y\u00f6ntemiyle, otomatik sistemler arac\u0131l\u0131\u011f\u0131yla binlerce kombinasyon deneyerek ele ge\u00e7irmeye \u00e7al\u0131\u015fan sald\u0131r\u0131 t\u00fcr\u00fcd\u00fcr.<\/li>\n<li>Sald\u0131r\u0131 asl\u0131nda parolan\u0131z\u0131 de\u011fil parola politikan\u0131zdaki bo\u015flu\u011fu hedef al\u0131r; k\u0131sa ve tahmin edilebilir parolalar daha ilk turda d\u00fc\u015fer.<\/li>\n<li>S\u00f6zl\u00fck sald\u0131r\u0131s\u0131 haz\u0131r parola listeleriyle ilerler, credential stuffing ise ba\u015fka bir siteden s\u0131zm\u0131\u015f kullan\u0131c\u0131 ad\u0131 ve parola \u00e7iftini sizde dener.<\/li>\n<li>En \u00e7ok zorlanan kap\u0131lar WordPress y\u00f6netim paneli, FTP, SSH, posta sunucusu ve hosting paneli giri\u015fleridir.<\/li>\n<li>Sald\u0131r\u0131 ba\u015far\u0131s\u0131z olsa bile zarar verir; her deneme bir s\u00fcre\u00e7 ve veritaban\u0131 sorgusu ba\u015flat\u0131r, site yava\u015flar, kaynak limiti dolar.<\/li>\n<li>Savunma tek bir \u00f6nlem de\u011fil katmand\u0131r: uzun parola, iki ad\u0131ml\u0131 do\u011frulama, giri\u015f deneme s\u0131n\u0131r\u0131, IP engelleme ve kullan\u0131lmayan servislerin kapat\u0131lmas\u0131.<\/li>\n<\/ul>\n<\/div>\n<p>Site bir sabah a\u011f\u0131rla\u015f\u0131r, panel &#8220;kaynak a\u015f\u0131m\u0131&#8221; uyar\u0131s\u0131 verir, ziyaret\u00e7i say\u0131s\u0131 ise d\u00fcnk\u00fc gibidir. Eri\u015fim g\u00fcnl\u00fc\u011f\u00fcne bak\u0131nca sebep ortaya \u00e7\u0131kar: ayn\u0131 adresten dakikada onlarca giri\u015f denemesi. Kimse i\u00e7eri girememi\u015ftir ama sunucu b\u00fct\u00fcn gece cevap vermekle me\u015fgul olmu\u015ftur. Bu yaz\u0131da brute force nedir sorusunu, sald\u0131r\u0131n\u0131n hangi kap\u0131lar\u0131 zorlad\u0131\u011f\u0131n\u0131 ve sizin taraf\u0131n\u0131zda hangi katmanlar\u0131n kurulmas\u0131 gerekti\u011fini anlat\u0131yoruz.<\/p>\n<h2>Brute force nedir ve sald\u0131rgan nas\u0131l ilerler?<\/h2>\n<p>Brute force, T\u00fcrk\u00e7ede kaba kuvvet sald\u0131r\u0131s\u0131 olarak ge\u00e7er. Mant\u0131\u011f\u0131 basittir: bir kullan\u0131c\u0131 ad\u0131na kar\u015f\u0131l\u0131k gelen parolay\u0131 bulana kadar sistematik bi\u00e7imde deneme yapmak. \u0130nsan eliyle de\u011fil, otomatik olarak, kesintisiz ve \u00e7o\u011fu zaman birden fazla kaynaktan ayn\u0131 anda.<\/p>\n<p>Sald\u0131rgan\u0131n i\u015fini kolayla\u015ft\u0131ran \u015fey h\u0131z de\u011fil, hedefin \u00f6ng\u00f6r\u00fclebilirli\u011fidir. Kullan\u0131c\u0131 ad\u0131 \u00e7o\u011fu kurulumda zaten tahmin edilebilir durumdad\u0131r; &#8220;admin&#8221;, \u015firket ad\u0131 ya da e-posta adresinin ba\u015f k\u0131sm\u0131 s\u0131k rastlanan se\u00e7imlerdir. Geriye yaln\u0131zca parola kal\u0131r. Parola k\u0131sa, anlaml\u0131 bir kelime ya da bir tarih i\u00e7eriyorsa denenecek ihtimal say\u0131s\u0131 ciddi bi\u00e7imde k\u00fc\u00e7\u00fcl\u00fcr.<\/p>\n<div class=\"highlight-box\">\n<p class=\"label\">Bilgi<\/p>\n<p>Kaba kuvvet sald\u0131r\u0131s\u0131 ile araya girme sald\u0131r\u0131s\u0131 ayn\u0131 \u015fey de\u011fildir. HTTPS ba\u011flant\u0131s\u0131 trafi\u011finizi \u015fifreler ve parolan\u0131z\u0131n hat \u00fczerinde okunmas\u0131n\u0131 engeller; ama do\u011fru parolay\u0131 deneme yan\u0131lmayla bulan birini durdurmaz. \u015eifreleme katman\u0131n\u0131n ne yapt\u0131\u011f\u0131n\u0131 <a href=\"https:\/\/narhost.com\/blog\/ssl-sertifikasi-nedir\/\" title=\"SSL sertifikas\u0131 nedir, t\u00fcrleri ve kurulumu\">SSL sertifikas\u0131 yaz\u0131m\u0131zda<\/a> ayr\u0131nt\u0131l\u0131 anlatt\u0131k.<\/p>\n<\/div>\n<h2>S\u00f6zl\u00fck sald\u0131r\u0131s\u0131 ve credential stuffing aras\u0131ndaki fark<\/h2>\n<p>Brute force nedir diye soranlar\u0131n \u00e7o\u011fu asl\u0131nda \u00fc\u00e7 ayr\u0131 y\u00f6ntemi kastediyor ve bu \u00fc\u00e7\u00fcn\u00fcn savunmas\u0131 birbirinden farkl\u0131. Saf kaba kuvvet karakter kombinasyonlar\u0131n\u0131 s\u0131rayla \u00fcretir ve en yava\u015f olan\u0131d\u0131r. S\u00f6zl\u00fck sald\u0131r\u0131s\u0131, insanlar\u0131n ger\u00e7ekte kulland\u0131\u011f\u0131 parolalardan derlenmi\u015f haz\u0131r listelerle \u00e7al\u0131\u015f\u0131r; \u00e7ok daha az denemeyle sonuca ula\u015ft\u0131\u011f\u0131 i\u00e7in yayg\u0131nd\u0131r.<\/p>\n<p>Credential stuffing ise bamba\u015fka bir mant\u0131k kurar. Ba\u015fka bir sitede ya\u015fanan veri s\u0131z\u0131nt\u0131s\u0131ndan elde edilen kullan\u0131c\u0131 ad\u0131 ve parola \u00e7iftleri, ayn\u0131 ki\u015finin di\u011fer hesaplar\u0131nda denenir. Burada parolan\u0131z\u0131n uzunlu\u011fu sizi kurtarmaz; sorun parolan\u0131n <em>tekrar kullan\u0131lm\u0131\u015f<\/em> olmas\u0131d\u0131r. Bu y\u00fczden panel parolan\u0131z, e-posta parolan\u0131z ve veritaban\u0131 parolan\u0131z birbirinden farkl\u0131 olmak zorundad\u0131r.<\/p>\n<div class=\"warn-box\">\n<p class=\"label\">Dikkat<\/p>\n<p>Ba\u015far\u0131s\u0131z giri\u015f denemelerinin hepsini &#8220;nas\u0131lsa giremiyorlar&#8221; diye ge\u00e7meyin. Deneme say\u0131s\u0131 yeterince artt\u0131\u011f\u0131nda hesap ele ge\u00e7irilmese bile site cevap veremez h\u00e2le gelir. Payla\u015f\u0131ml\u0131 hosting kullan\u0131yorsan\u0131z kaynak limitini doldurup kendi sitenizi kendiniz kapatm\u0131\u015f olursunuz; sunucu kullan\u0131yorsan\u0131z bellek ve i\u015flemci bask\u0131s\u0131 di\u011fer servislere yans\u0131r.<\/p>\n<\/div>\n<figure class=\"nh-sema\"><img loading=\"lazy\" src=\"https:\/\/narhost.com\/blog\/wp-content\/uploads\/2026\/09\/brute-force-nedir-sema-narhost.webp\" alt=\"Brute force nedir sorusunun savunma \u015femas\u0131 \u2014 parola, iki ad\u0131ml\u0131 do\u011frulama, deneme s\u0131n\u0131r\u0131 ve IP engelleme katmanlar\u0131\" width=\"1200\" height=\"500\" loading=\"lazy\" decoding=\"async\"><figcaption>Brute force nedir sorusunun pratik kar\u015f\u0131l\u0131\u011f\u0131: d\u00f6rt savunma katman\u0131 \u00fcst \u00fcste bindi\u011finde sald\u0131r\u0131n\u0131n maliyeti hedefi a\u015far.<\/figcaption><\/figure>\n<h2>En \u00e7ok hedeflenen giri\u015f noktalar\u0131 hangileri?<\/h2>\n<p>Sald\u0131r\u0131 trafi\u011fi rastgele da\u011f\u0131lmaz. Standart kurulumlarda adresi ba\u015ftan bilinen ve d\u0131\u015far\u0131ya a\u00e7\u0131k duran servisler \u00f6nce zorlan\u0131r. A\u015fa\u011f\u0131daki tablo hedefleri, g\u00fcnl\u00fcklerde b\u0131rakt\u0131klar\u0131 izi ve o kap\u0131ya \u00f6zg\u00fc savunmay\u0131 bir arada veriyor.<\/p>\n<table>\n<thead>\n<tr>\n<th>Hedef<\/th>\n<th>Belirti<\/th>\n<th>Savunma<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>WordPress y\u00f6netim paneli<\/td>\n<td>Eri\u015fim g\u00fcnl\u00fc\u011f\u00fcnde giri\u015f sayfas\u0131na dakikada onlarca istek, kaynak kullan\u0131m\u0131nda ani s\u0131\u00e7rama<\/td>\n<td>Giri\u015f deneme s\u0131n\u0131r\u0131, iki ad\u0131ml\u0131 do\u011frulama, giri\u015f adresinin de\u011fi\u015ftirilmesi<\/td>\n<\/tr>\n<tr>\n<td>FTP<\/td>\n<td>\u00c7ok say\u0131da ba\u015far\u0131s\u0131z oturum kayd\u0131, al\u0131\u015f\u0131lmad\u0131k \u00fclkelerden ba\u011flant\u0131<\/td>\n<td>FTP yerine \u015fifreli SFTP, kullan\u0131lmayan FTP hesaplar\u0131n\u0131n silinmesi, IP k\u0131s\u0131t\u0131<\/td>\n<\/tr>\n<tr>\n<td>SSH<\/td>\n<td>Kimlik do\u011frulama g\u00fcnl\u00fc\u011f\u00fcnde tekrarlayan ba\u015far\u0131s\u0131z kay\u0131tlar, bilinmeyen kullan\u0131c\u0131 adlar\u0131<\/td>\n<td>Parola yerine anahtarla giri\u015f, y\u00f6netici hesab\u0131yla do\u011frudan giri\u015fin kapat\u0131lmas\u0131, deneme s\u0131n\u0131r\u0131<\/td>\n<\/tr>\n<tr>\n<td>Posta sunucusu<\/td>\n<td>Giden kuyru\u011funda tan\u0131mad\u0131\u011f\u0131n\u0131z iletiler, sunucu adresinin kara listeye d\u00fc\u015fmesi<\/td>\n<td>Her posta kutusuna ayr\u0131 ve uzun parola, giden ileti limiti, eski hesaplar\u0131n kapat\u0131lmas\u0131<\/td>\n<\/tr>\n<tr>\n<td>Hosting paneli giri\u015fi<\/td>\n<td>Panel g\u00fcnl\u00fc\u011f\u00fcnde y\u0131\u011f\u0131n h\u00e2linde ba\u015far\u0131s\u0131z giri\u015f, oturum uyar\u0131lar\u0131<\/td>\n<td>Panel giri\u015fini IP ile s\u0131n\u0131rlama, iki ad\u0131ml\u0131 do\u011frulama, y\u00f6netici say\u0131s\u0131n\u0131 azaltma<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Listedeki ortak nokta dikkat \u00e7ekicidir. Hedeflerin \u00e7o\u011fu, kurulum s\u0131ras\u0131nda a\u00e7\u0131l\u0131p sonra kullan\u0131lmad\u0131\u011f\u0131 h\u00e2lde a\u00e7\u0131k b\u0131rak\u0131lan servislerdir. Kullanmad\u0131\u011f\u0131n\u0131z her giri\u015f noktas\u0131, savunman\u0131z gereken bir kap\u0131 daha demektir.<\/p>\n<h2>Brute force nedir sorusunun sunucu taraf\u0131ndaki kar\u015f\u0131l\u0131\u011f\u0131<\/h2>\n<p>Konuya yaln\u0131zca hesap g\u00fcvenli\u011fi olarak bakmak eksik kal\u0131r. Giri\u015f sayfas\u0131na gelen her istek bo\u015fa gitmez; sunucu taraf\u0131nda ger\u00e7ek bir maliyet \u00fcretir. \u0130stek bir PHP s\u00fcreci ba\u015flat\u0131r, oturum kontrol\u00fc i\u00e7in veritaban\u0131na sorgu gider, parola kar\u015f\u0131la\u015ft\u0131rmas\u0131 i\u015flemci harcar. Tek istek i\u00e7in bunlar \u00f6nemsizdir, saniyede onlarca istek i\u00e7in de\u011fildir.<\/p>\n<p>Sonu\u00e7 genellikle \u015f\u00f6yle g\u00f6r\u00fcn\u00fcr: site a\u00e7\u0131l\u0131yor ama a\u011f\u0131r, y\u00f6netim paneli tepki vermiyor, arada 503 hatas\u0131 d\u00fc\u015f\u00fcyor. Ziyaret\u00e7i trafi\u011finde bir art\u0131\u015f olmad\u0131\u011f\u0131 i\u00e7in sebep uzun s\u00fcre anla\u015f\u0131lamaz. Payla\u015f\u0131ml\u0131 pakette bar\u0131n\u0131yorsan\u0131z kaynak limitiniz dolar; sanal ya da fiziksel sunucudaysan\u0131z bellek t\u00fckenir ve veritaban\u0131 servisi d\u00fc\u015fer.<\/p>\n<div class=\"senaryo-block\">\n<p class=\"label\">\u00d6rnek senaryo<\/p>\n<p>Bir mobilya \u00fcreticisinin kurumsal sitesi hafta sonu boyunca a\u00e7\u0131lmad\u0131, pazartesi kendili\u011finden d\u00fczeldi. Eri\u015fim g\u00fcnl\u00fc\u011f\u00fcnde iki g\u00fcn boyunca y\u00f6netim paneline gelen y\u00fcz binin \u00fczerinde istek vard\u0131. Hi\u00e7biri ba\u015far\u0131l\u0131 olmam\u0131\u015ft\u0131. Firma giri\u015f deneme s\u0131n\u0131r\u0131n\u0131 be\u015f denemeyle s\u0131n\u0131rland\u0131rd\u0131, y\u00f6netici hesab\u0131na iki ad\u0131ml\u0131 do\u011frulama tan\u0131mlad\u0131 ve tekrarlayan adresleri g\u00fcvenlik duvar\u0131nda engelledi. Sonraki hafta ayn\u0131 trafik geldi ama sitede yava\u015flama g\u00f6r\u00fclmedi, \u00e7\u00fcnk\u00fc istekler giri\u015f sayfas\u0131na ula\u015fmadan kesiliyordu.<\/p>\n<\/div>\n<h2>Savunmay\u0131 katman katman kurun<\/h2>\n<p>Tek bir \u00f6nleme yaslanan kurulum k\u0131r\u0131lgand\u0131r. Etkili olan, her biri sald\u0131r\u0131n\u0131n farkl\u0131 bir a\u015famas\u0131n\u0131 zorla\u015ft\u0131ran katmanlar\u0131n \u00fcst \u00fcste binmesidir.<\/p>\n<p><strong>Parola politikas\u0131.<\/strong> Uzunluk, karma\u015f\u0131kl\u0131ktan daha belirleyicidir. Birbiriyle ilgisiz kelimelerden kurulu uzun bir parola, k\u0131sa ve sembol dolu bir paroladan daha dayan\u0131kl\u0131d\u0131r. Her servis i\u00e7in ayr\u0131 parola kullan\u0131n ve bunlar\u0131 bir parola y\u00f6neticisinde saklay\u0131n. Uluslararas\u0131 kabul g\u00f6ren kimlik do\u011frulama \u00f6nerileri <a href=\"https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/Authentication_Cheat_Sheet.html\" title=\"OWASP Authentication Cheat Sheet \u2014 kimlik do\u011frulama g\u00fcvenlik \u00f6nerileri\" target=\"_blank\" rel=\"noopener\">OWASP kimlik do\u011frulama rehberinde<\/a> toplu h\u00e2lde bulunuyor.<\/p>\n<p><strong>\u0130ki ad\u0131ml\u0131 do\u011frulama.<\/strong> Parola ele ge\u00e7se bile giri\u015f tamamlanmaz. Y\u00f6netici yetkisi olan her hesapta a\u00e7\u0131lmal\u0131d\u0131r; blog yazar\u0131 hesaplar\u0131 i\u00e7in bile ihmal edilmemesi gerekir.<\/p>\n<p><strong>Giri\u015f deneme s\u0131n\u0131r\u0131.<\/strong> Belirli say\u0131da ba\u015far\u0131s\u0131z denemeden sonra hesab\u0131n ya da adresin ge\u00e7ici olarak kilitlenmesi, sald\u0131r\u0131n\u0131n ekonomisini bozar. WordPress taraf\u0131nda bu i\u015fi \u00fcstlenen eklentileri <a href=\"https:\/\/narhost.com\/blog\/en-iyi-wordpress-eklentileri\/\" title=\"En iyi WordPress eklentileri \u2014 g\u00fcvenlik ve performans se\u00e7imleri\">eklenti se\u00e7imi yaz\u0131m\u0131zda<\/a> ele ald\u0131k.<\/p>\n<p><strong>IP engelleme ve k\u0131s\u0131tlama.<\/strong> Tekrarlayan adresler g\u00fcvenlik duvar\u0131 seviyesinde engellenir. Y\u00f6netim paneline yaln\u0131zca ofis ya da sabit adresinizden eri\u015fiyorsan\u0131z giri\u015fi t\u00fcm\u00fcyle o adrese k\u0131s\u0131tlamak en kesin \u00e7\u00f6z\u00fcmd\u00fcr.<\/p>\n<p><strong>Giri\u015f adresini de\u011fi\u015ftirme.<\/strong> Standart y\u00f6netim adresini farkl\u0131 bir adrese ta\u015f\u0131mak sald\u0131r\u0131y\u0131 imk\u00e2ns\u0131z k\u0131lmaz ama otomatik trafi\u011fin b\u00fcy\u00fck b\u00f6l\u00fcm\u00fcn\u00fc hedefsiz b\u0131rak\u0131r. Tek ba\u015f\u0131na de\u011fil, di\u011fer katmanlarla birlikte anlaml\u0131d\u0131r.<\/p>\n<p><strong>Kullan\u0131lmayan servisleri kapatma.<\/strong> Y\u0131llar \u00f6nce a\u00e7\u0131lm\u0131\u015f bir FTP hesab\u0131, devredilmi\u015f bir posta kutusu ya da art\u0131k kullan\u0131lmayan bir alt panel giri\u015fi savunmas\u0131z kap\u0131lard\u0131r. Hesap listelerini alt\u0131 ayda bir g\u00f6zden ge\u00e7irin. Sunucu g\u00fcvenli\u011fini s\u0131k\u0131la\u015ft\u0131rma ad\u0131mlar\u0131 i\u00e7in <a href=\"https:\/\/developer.wordpress.org\/advanced-administration\/security\/hardening\/\" title=\"WordPress resm\u00ee g\u00fcvenlik s\u0131k\u0131la\u015ft\u0131rma dok\u00fcman\u0131\" target=\"_blank\" rel=\"noopener\">WordPress resm\u00ee s\u0131k\u0131la\u015ft\u0131rma dok\u00fcman\u0131<\/a> iyi bir ba\u015flang\u0131\u00e7 noktas\u0131d\u0131r.<\/p>\n<h2>G\u00fcnl\u00fcklerden sald\u0131r\u0131y\u0131 nas\u0131l fark edersiniz?<\/h2>\n<p>Brute force nedir sorusuna verilecek en somut cevap g\u00fcnl\u00fck kay\u0131tlar\u0131nda duruyor; sunucu sald\u0131r\u0131y\u0131 sessizce kaydeder, yeter ki bak\u0131ls\u0131n. Eri\u015fim g\u00fcnl\u00fc\u011f\u00fcnde ayn\u0131 adresten gelen ve hepsi giri\u015f sayfas\u0131na y\u00f6nelen k\u0131sa aral\u0131kl\u0131 istekler ilk i\u015farettir. Kimlik do\u011frulama g\u00fcnl\u00fc\u011f\u00fcnde arka arkaya ba\u015far\u0131s\u0131z kay\u0131tlar, \u00fcstelik sizde hi\u00e7 tan\u0131ml\u0131 olmayan kullan\u0131c\u0131 adlar\u0131yla, ikinci i\u015farettir.<\/p>\n<p>\u00dc\u00e7\u00fcnc\u00fc i\u015faret dolayl\u0131d\u0131r: kaynak kullan\u0131m grafi\u011finde ziyaret\u00e7i say\u0131s\u0131yla a\u00e7\u0131klanamayan s\u0131\u00e7ramalar. Bu \u00fc\u00e7\u00fc bir aradaysa de\u011ferlendirme nettir. Panel \u00fczerinden g\u00fcnl\u00fcklere eri\u015femiyorsan\u0131z hosting sa\u011flay\u0131c\u0131n\u0131zdan belirli bir tarih aral\u0131\u011f\u0131 i\u00e7in eri\u015fim kayd\u0131 isteyebilirsiniz.<\/p>\n<h2>Sald\u0131r\u0131 sonras\u0131nda ne yapmal\u0131s\u0131n\u0131z?<\/h2>\n<p>Giri\u015fin ba\u015far\u0131l\u0131 oldu\u011fundan \u015f\u00fcpheleniyorsan\u0131z s\u0131ralama \u00f6nemlidir. \u00d6nce b\u00fct\u00fcn y\u00f6netici parolalar\u0131 de\u011fi\u015ftirilir, ard\u0131ndan a\u00e7\u0131k oturumlar sonland\u0131r\u0131l\u0131r. Sonra kullan\u0131c\u0131 listesi kontrol edilir; sonradan eklenmi\u015f yetkili hesaplar silinir. Veritaban\u0131 ve dosya sistemi, siz eklemedi\u011finiz h\u00e2lde de\u011fi\u015fmi\u015f dosyalar i\u00e7in kar\u015f\u0131la\u015ft\u0131r\u0131l\u0131r.<\/p>\n<p>Temiz bir yede\u011finiz varsa toparlanma \u00e7ok daha h\u0131zl\u0131 olur. Yedek yoksa hangi dosyan\u0131n ne zaman de\u011fi\u015fti\u011fini \u00e7\u00f6zmek g\u00fcnler alabilir. Yedek d\u00fczeninizin nas\u0131l kurulmas\u0131 gerekti\u011fini <a href=\"https:\/\/narhost.com\/blog\/hosting-yedeklemesi-neden-onemli\/\" title=\"Hosting yedeklemesi neden \u00f6nemli \u2014 yedek alma d\u00fczeni\">yedekleme yaz\u0131m\u0131zda<\/a> anlatt\u0131k.<\/p>\n<div class=\"success-box\">\n<p class=\"label\">Sonu\u00e7<\/p>\n<p>Brute force nedir sorusunun pratik kar\u015f\u0131l\u0131\u011f\u0131 \u015fudur: sab\u0131rl\u0131, otomatik ve ucuz bir sald\u0131r\u0131. Bu y\u00fczden onu pahal\u0131 h\u00e2le getiren savunmalar i\u015fe yarar. Uzun ve tekrars\u0131z parola, iki ad\u0131ml\u0131 do\u011frulama, deneme s\u0131n\u0131r\u0131 ve kullan\u0131lmayan servislerin kapat\u0131lmas\u0131 bir araya geldi\u011finde sald\u0131rgan\u0131n hesab\u0131 tutmaz ve hedef de\u011fi\u015ftirir.<\/p>\n<\/div>\n<h2>Uygulanabilir kontrol listesi<\/h2>\n<ul class=\"kontrol-listesi\">\n<li>Y\u00f6netici hesaplar\u0131n\u0131n parolalar\u0131n\u0131 uzun ve birbirinden farkl\u0131 h\u00e2le getirin.<\/li>\n<li>Yetkili her hesapta iki ad\u0131ml\u0131 do\u011frulamay\u0131 a\u00e7\u0131n.<\/li>\n<li>Giri\u015f deneme s\u0131n\u0131r\u0131n\u0131 tan\u0131mlay\u0131n ve kilitlenme s\u00fcresini belirleyin.<\/li>\n<li>Tekrarlayan sald\u0131rgan adresleri g\u00fcvenlik duvar\u0131nda engelleyin.<\/li>\n<li>Y\u00f6netim paneline eri\u015fimi m\u00fcmk\u00fcnse sabit adresinizle s\u0131n\u0131rlay\u0131n.<\/li>\n<li>Kullan\u0131lmayan FTP, posta ve panel hesaplar\u0131n\u0131 silin.<\/li>\n<li>Eri\u015fim ve kimlik do\u011frulama g\u00fcnl\u00fcklerini ayda bir g\u00f6zden ge\u00e7irin.<\/li>\n<li>Yedeklerin al\u0131nd\u0131\u011f\u0131n\u0131 ve geri y\u00fcklenebildi\u011fini d\u00fczenli olarak do\u011frulay\u0131n.<\/li>\n<\/ul>\n<div class=\"kb-faq\">\n<h2>S\u0131k\u00e7a sorulan sorular<\/h2>\n<h3>Brute force nedir, kimler hedef olur?<\/h3>\n<p>Parolay\u0131 deneme yan\u0131lmayla bulmaya \u00e7al\u0131\u015fan otomatik sald\u0131r\u0131 t\u00fcr\u00fcd\u00fcr. Hedef se\u00e7imi ki\u015fisel de\u011fildir; tarama yapan sistemler internete a\u00e7\u0131k b\u00fct\u00fcn giri\u015f noktalar\u0131n\u0131 s\u0131rayla dener. K\u00fc\u00e7\u00fck bir tan\u0131t\u0131m sitesi de kurumsal bir portal kadar s\u0131k zorlan\u0131r.<\/p>\n<h3>Site yava\u015flad\u0131, sebebi sald\u0131r\u0131 m\u0131 anlayabilir miyim?<\/h3>\n<p>Eri\u015fim g\u00fcnl\u00fc\u011f\u00fcnde ziyaret\u00e7i say\u0131s\u0131yla orant\u0131s\u0131z bi\u00e7imde \u00e7ok say\u0131da giri\u015f iste\u011fi g\u00f6r\u00fcyorsan\u0131z kuvvetli bir i\u015farettir. Kaynak kullan\u0131m\u0131ndaki art\u0131\u015f\u0131n trafik art\u0131\u015f\u0131yla a\u00e7\u0131klanamamas\u0131 da ayn\u0131 y\u00f6ne i\u015faret eder.<\/p>\n<h3>Giri\u015f adresini de\u011fi\u015ftirmek tek ba\u015f\u0131na yeterli mi?<\/h3>\n<p>Hay\u0131r. Otomatik trafi\u011fin \u00f6nemli b\u00f6l\u00fcm\u00fcn\u00fc hedefsiz b\u0131rak\u0131r ve sunucu y\u00fck\u00fcn\u00fc d\u00fc\u015f\u00fcr\u00fcr, ancak adres \u00f6\u011frenildi\u011finde koruma ortadan kalkar. Deneme s\u0131n\u0131r\u0131 ve iki ad\u0131ml\u0131 do\u011frulamayla birlikte kullan\u0131lmal\u0131d\u0131r.<\/p>\n<h3>\u0130ki ad\u0131ml\u0131 do\u011frulama kullan\u0131c\u0131 deneyimini zorla\u015ft\u0131rmaz m\u0131?<\/h3>\n<p>Yaln\u0131zca y\u00f6netici ve edit\u00f6r hesaplar\u0131nda a\u00e7arsan\u0131z ziyaret\u00e7i taraf\u0131nda hi\u00e7bir de\u011fi\u015fiklik olmaz. Y\u00f6netici i\u00e7in de g\u00fcnde bir kez uygulanan k\u0131sa bir ad\u0131md\u0131r; hesab\u0131n ele ge\u00e7mesinin maliyetiyle k\u0131yaslanamaz.<\/p>\n<h3>Hosting paketi bu sald\u0131r\u0131lar\u0131 kendisi engellemez mi?<\/h3>\n<p>Sunucu taraf\u0131nda baz\u0131 \u00f6nlemler bulunur, ancak uygulama seviyesindeki giri\u015f korumas\u0131n\u0131 site sahibi kurar. Sunucunun hangi i\u015fi \u00fcstlendi\u011fini ve sizin hangi katmandan sorumlu oldu\u011funuzu <a href=\"https:\/\/narhost.com\/blog\/wordpress-icin-en-iyi-hosting-tercihi\/\" title=\"WordPress i\u00e7in en iyi hosting tercihi nas\u0131l yap\u0131l\u0131r\">WordPress hosting tercihi yaz\u0131m\u0131zda<\/a> kar\u015f\u0131la\u015ft\u0131rd\u0131k.<\/p>\n<\/div>\n<p>\u0130lgili bir karar i\u00e7in <a href=\"https:\/\/narhost.com\/blog\/sql-injection-nedir\/\" title=\"SQL Injection Nedir, Siteniz Neden Risk Alt\u0131nda \u2014 Narhost Blog\">SQL injection nedir<\/a> yaz\u0131s\u0131n\u0131 da okuyun.<\/p>\n<div class=\"cta-box\">\n<p class=\"label\">Narhost&#8217;ta<\/p>\n<p>WordPress hosting paketlerinde \u00fccretsiz SSL, T\u00fcrk\u00e7e cPanel ve tek t\u0131kla WordPress kurulumu haz\u0131r gelir; g\u00fcvenlik eklentilerinizi kurup giri\u015f korumas\u0131n\u0131 ilk g\u00fcnden devreye alabilirsiniz.<\/p>\n<p><a class=\"cta-btn\" href=\"https:\/\/narhost.com\/wordpress-hosting\" title=\"Narhost WordPress hosting paketleri\">WordPress hosting paketlerini incele<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Brute force nedir sorusunun cevab\u0131, sald\u0131r\u0131n\u0131n en \u00e7ok zorlad\u0131\u011f\u0131 giri\u015f noktalar\u0131, sunucu kaynaklar\u0131na etkisi ve parola politikas\u0131ndan IP engellemeye uzanan savunma katmanlar\u0131.<\/p>\n","protected":false},"author":1,"featured_media":2310,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[],"class_list":["post-496","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-guvenlik"],"_links":{"self":[{"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/posts\/496","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/comments?post=496"}],"version-history":[{"count":5,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/posts\/496\/revisions"}],"predecessor-version":[{"id":2974,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/posts\/496\/revisions\/2974"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/media\/2310"}],"wp:attachment":[{"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/media?parent=496"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/categories?post=496"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/tags?post=496"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}