Your security plugin or your host suddenly reports hundreds of failed login attempts on your site, and you’re wondering if you should be concerned. Secure your WordPress login with two-factor authentication, a limit on login attempts, a unique administrator account that isn’t named “admin,” strong passwords from a password manager, and, where possible, a customized login URL or IP restriction. wp-admin. Failed attempts are normal; a successful one is the problem. Below, you'll find out which measures are most effective and which approaches almost everyone overlooks.
What a brute-force attack on your login is
A brute-force attack is the process of automatically trying out usernames and passwords on wp-login.php, until one of them works. There’s rarely a person behind it. It’s a bot that has found your login page, and that’s not hard, because /wp-admin and /wp-login.php are located in the same place on every WordPress site. A more sophisticated method is credential stuffing. In this case, the bot doesn’t try random passwords, but rather combinations of email addresses and passwords that were leaked in a data breach on another site. If you use the same password everywhere, it won’t take more than a few attempts to crack it. If you see hundreds of attempts per day in your logs, that doesn’t mean your site has been hacked—it just means it’s been discovered. Also, always log in via HTTPS so your password can’t be intercepted during transmission. We provide SSL by default and free of charge via Let’s Encrypt.
Two-factor authentication: the measure with the greatest impact
The measure with the greatest impact is two-factor authentication; using a different login URL has the least impact. Two-factor authentication (2FA) requires a second form of verification in addition to your password—usually a code from an app on your phone. A leaked password is no longer enough, because the attacker doesn’t have your phone. Think of it as a second lock on the door that only opens with something you carry with you. Incidentally, 2FA is the most commonly used form of multi-factor authentication (MFA), so if you come across that term, it refers to the same concept. My advice is to use an authenticator app (TOTP) instead of codes sent via email or text message. Some plugins also support a hardware key or passkey, which offers even stronger security. You can set up WordPress 2FA using a plugin like Two Factor or WP 2FA.
- Install and activate the plugin.
- Go to Users > Profile and select the authenticator app as the method.
- Scan the QR code with your app and enter the code to verify it.
- Save the backup codes in your password manager.
- Make 2FA mandatory in the plugin on a per-role basis, at least for administrators and editors.
- Test the new login in a private window before you log out.
I never skip that last step. If something goes wrong, you'll still be logged in and can fix it without locking yourself out.
Passwords, login attempts, and the admin account
Using a unique password for each site makes credential stuffing impossible, and that’s more important than whether the password is long or complex. Let a password manager generate and remember it for you, so you don’t have to worry about it yourself. You can read more about this in password managers and secure passwords.
A limit on login attempts thwarts brute-force attacks and temporarily blocks an IP address after a few failed attempts. This can be done with a plugin such as Limit Login Attempts Reloaded, or directly on the server. The difference is greater than it seems. A plugin only intervenes once WordPress has already loaded, whereas a server-level limit blocks the attempt before WordPress starts—for example, by displaying a CAPTCHA page after more than ten failed attempts. That server-side approach is part of good Managed WordPress Hosting, and you can read more about the decision-making process at server-level firewall. To be fair, though, such a limit isn't very effective against botnets that attempt logins from thousands of IP addresses at once. That's why 2FA is the top priority.
If your administrator account is still named “admin,” you’re essentially giving the bot half of your login credentials. Create a new administrator account, transfer the content, and delete the old account. Also pay attention to your display name. If it’s the same as your login name, your username will appear in your site’s author archive. And don’t give everyone the administrator role. In User Roles in WordPress You'll learn which role is best suited for each task.
Secure wp-admin and change the login URL
With an IP restriction, wp-admin Accessible only from static IP addresses, such as your office network. You can configure this via .htaccess or your hosting control panel. It works well for small teams in a fixed location, but if you have a changing IP address at home or while traveling, you’ll lock yourself out. If you don’t have a static IP address, adding an extra password to the folder is a good alternative. In cPanel, this is called Directory Privacy, and it uses HTTP authentication. Just make sure that admin-ajax.php remains accessible, because many plugins and themes also use that file for visitors.
Using a different login URL reduces the noise in your logs, but it’s not a real security measure. It’s like moving your front door to the side of the house. Most bots will then pass it by, but those who are determined will find it anyway. If you want to do this, use a plugin like WPS Hide Login and never modify core files, because the next update will revert those changes. After making the change, it works /wp-admin Don't bookmark it anymore. To find out how to log in, see Log in to your WordPress website.
Don't forget the backdoors next to your login page
Your login page isn't the only entry point, and the other entry points are most often overlooked during security checks. XML-RPC (xmlrpc.php) is an older plugin that allows apps to log in remotely, and attackers use it to try many passwords at once. Disable it if you aren't using it, but first check to make sure Jetpack or the WordPress app don't depend on it. Also check under Users > Profile for application passwords. These bypass 2FA when accessing the API, so delete anything you don't recognize.
After that, you’ll be working outside of WordPress. Your hosting control panel gives you access to everything, so set up 2FA on your customer account at my.surver.nl and on cPanel, and use SFTP with a strong, unique password. Don’t forget the administrator’s email account, either. Password resets are sent via email, so setting up 2FA on WordPress without a well-secured email account is only half the battle. The same goes for the email account at your email hosting. If an employee or agency leaves, delete or demote the account and log in via Users > Profile All sessions are held elsewhere.
What we do at Surver for all shared hosting packages is block a large portion of those login attempts before WordPress loads. A ModSecurity firewall, Bot Blocker, and automatic IP blocking intercept most bot traffic. Within WordPress Management In addition, Business login protection with 2FA and an activity log is included. If you notice an unknown administrator account or a login you can't explain, someone may already have gained access. In that case, check WordPress hacked or in the steps to Removing malware from WordPress, and read on for the bigger picture WordPress Security and The Seven Causes of a WordPress Hack.
Frequently Asked Questions
I lost my phone with the 2FA app on it. How do I log in?
Log in using one of your backup codes. If you don't have any, temporarily rename the 2FA plugin folder via SFTP or File Manager wp-content/plugins, so that the plugin is disabled. If that doesn't work, please contact your hosting provider.
Which 2FA method is the most secure?
An authenticator app or a hardware key. A free app like Google Authenticator or Authy works just fine. Email codes are only as secure as your email account, and text messages are the least secure option.
How many login attempts should I allow?
A handful of temporary blocks per IP address is a good starting point. On Surver shared hosting, an IP address is blocked after more than ten failed login attempts, including on wp-admin, automatically displays a CAPTCHA page.
