{"id":20420,"date":"2026-11-02T12:28:28","date_gmt":"2026-11-02T11:28:28","guid":{"rendered":"https:\/\/stage.surver.nl\/kennisbank\/wordpress-login-beveiligen\/"},"modified":"2026-11-03T14:54:01","modified_gmt":"2026-11-03T13:54:01","slug":"securing-the-wordpress-login","status":"publish","type":"kennisbank","link":"https:\/\/stage.surver.nl\/en\/kennisbank\/wordpress-login-beveiligen\/","title":{"rendered":"Securing Your WordPress Login: Two-Factor Authentication, Login Attempts, and wp-admin"},"content":{"rendered":"
\"Securing<\/figure>\n\n\n\n

Your security plugin or your host suddenly reports hundreds of failed login attempts on your site, and you\u2019re wondering if you should be concerned. Secure your WordPress login with two-factor authentication, a limit on login attempts, a unique administrator account that isn\u2019t named \u201cadmin,\u201d strong passwords from a password manager, and, where possible, a customized login URL or IP restriction. wp-admin<\/code>. Failed attempts are normal; a successful one is the problem. Below, you'll find out which measures are most effective and which approaches almost everyone overlooks.<\/p>\n\n\n\n

What a brute-force attack on your login is<\/h2>\n\n\n\n

A brute-force attack is the process of automatically trying out usernames and passwords on wp-login.php<\/code>, until one of them works. There\u2019s rarely a person behind it. It\u2019s a bot that has found your login page, and that\u2019s not hard, because \/wp-admin<\/code> and \/wp-login.php<\/code> are located in the same place on every WordPress site. A more sophisticated method is credential stuffing. In this case, the bot doesn\u2019t try random passwords, but rather combinations of email addresses and passwords that were leaked in a data breach on another site. If you use the same password everywhere, it won\u2019t take more than a few attempts to crack it. If you see hundreds of attempts per day in your logs, that doesn\u2019t mean your site has been hacked\u2014it just means it\u2019s been discovered. Also, always log in via HTTPS so your password can\u2019t be intercepted during transmission. We provide SSL by default and free of charge via Let\u2019s Encrypt.<\/p>\n\n\n\n

Two-factor authentication: the measure with the greatest impact<\/h2>\n\n\n\n

The measure with the greatest impact is two-factor authentication; using a different login URL has the least impact. Two-factor authentication (2FA) requires a second form of verification in addition to your password\u2014usually a code from an app on your phone. A leaked password is no longer enough, because the attacker doesn\u2019t have your phone. Think of it as a second lock on the door that only opens with something you carry with you. Incidentally, 2FA is the most commonly used form of multi-factor authentication (MFA), so if you come across that term, it refers to the same concept. My advice is to use an authenticator app (TOTP) instead of codes sent via email or text message. Some plugins also support a hardware key or passkey, which offers even stronger security. You can set up WordPress 2FA using a plugin like Two Factor or WP 2FA.<\/p>\n\n\n\n

    \n
  1. Install and activate the plugin.<\/li>\n\n
  2. Go to Users > Profile<\/strong> and select the authenticator app as the method.<\/li>\n\n
  3. Scan the QR code with your app and enter the code to verify it.<\/li>\n\n
  4. Save the backup codes in your password manager.<\/li>\n\n
  5. Make 2FA mandatory in the plugin on a per-role basis, at least for administrators and editors.<\/li>\n\n
  6. Test the new login in a private window before you log out.<\/li>\n<\/ol>\n\n\n\n

    I never skip that last step. If something goes wrong, you'll still be logged in and can fix it without locking yourself out.<\/p>\n\n\n\n

    Passwords, login attempts, and the admin account<\/h2>\n\n\n\n

    Using a unique password for each site makes credential stuffing impossible, and that\u2019s more important than whether the password is long or complex. Let a password manager generate and remember it for you, so you don\u2019t have to worry about it yourself. You can read more about this in password managers and secure passwords<\/a>.<\/p>\n\n\n\n

    A limit on login attempts thwarts brute-force attacks and temporarily blocks an IP address after a few failed attempts. This can be done with a plugin such as Limit Login Attempts Reloaded, or directly on the server. The difference is greater than it seems. A plugin only intervenes once WordPress has already loaded, whereas a server-level limit blocks the attempt before WordPress starts\u2014for example, by displaying a CAPTCHA page after more than ten failed attempts. That server-side approach is part of good Managed WordPress Hosting<\/a>, and you can read more about the decision-making process at server-level firewall<\/a>. To be fair, though, such a limit isn't very effective against botnets that attempt logins from thousands of IP addresses at once. That's why 2FA is the top priority.<\/p>\n\n\n\n

    If your administrator account is still named \u201cadmin,\u201d you\u2019re essentially giving the bot half of your login credentials. Create a new administrator account, transfer the content, and delete the old account. Also pay attention to your display name. If it\u2019s the same as your login name, your username will appear in your site\u2019s author archive. And don\u2019t give everyone the administrator role. In User Roles in WordPress<\/a> You'll learn which role is best suited for each task.<\/p>\n\n\n\n

    Secure wp-admin and change the login URL<\/h2>\n\n\n\n

    With an IP restriction, wp-admin<\/code> Accessible only from static IP addresses, such as your office network. You can configure this via .htaccess<\/code> or your hosting control panel. It works well for small teams in a fixed location, but if you have a changing IP address at home or while traveling, you\u2019ll lock yourself out. If you don\u2019t have a static IP address, adding an extra password to the folder is a good alternative. In cPanel, this is called Directory Privacy<\/strong>, and it uses HTTP authentication. Just make sure that admin-ajax.php<\/code> remains accessible, because many plugins and themes also use that file for visitors.<\/p>\n\n\n\n

    Using a different login URL reduces the noise in your logs, but it\u2019s not a real security measure. It\u2019s like moving your front door to the side of the house. Most bots will then pass it by, but those who are determined will find it anyway. If you want to do this, use a plugin like WPS Hide Login and never modify core files, because the next update will revert those changes. After making the change, it works \/wp-admin<\/code> Don't bookmark it anymore. To find out how to log in, see Log in to your WordPress website<\/a>.<\/p>\n\n\n\n

    Don't forget the backdoors next to your login page<\/h2>\n\n\n\n

    Your login page isn't the only entry point, and the other entry points are most often overlooked during security checks. XML-RPC (xmlrpc.php<\/code>) is an older plugin that allows apps to log in remotely, and attackers use it to try many passwords at once. Disable it if you aren't using it, but first check to make sure Jetpack or the WordPress app don't depend on it. Also check under Users > Profile<\/strong> for application passwords. These bypass 2FA when accessing the API, so delete anything you don't recognize.<\/p>\n\n\n\n

    After that, you\u2019ll be working outside of WordPress. Your hosting control panel gives you access to everything, so set up 2FA on your customer account at my.surver.nl and on cPanel, and use SFTP with a strong, unique password. Don\u2019t forget the administrator\u2019s email account, either. Password resets are sent via email, so setting up 2FA on WordPress without a well-secured email account is only half the battle. The same goes for the email account at your email hosting<\/a>. If an employee or agency leaves, delete or demote the account and log in via Users > Profile<\/strong> All sessions are held elsewhere.<\/p>\n\n\n\n

    What we do at Surver for all shared hosting packages is block a large portion of those login attempts before WordPress loads. A ModSecurity firewall, Bot Blocker, and automatic IP blocking intercept most bot traffic. Within WordPress Management<\/a> In addition, Business login protection with 2FA and an activity log is included. If you notice an unknown administrator account or a login you can't explain, someone may already have gained access. In that case, check WordPress hacked<\/a> or in the steps to Removing malware from WordPress<\/a>, and read on for the bigger picture WordPress Security<\/a> and The Seven Causes of a WordPress Hack<\/a>.<\/p>\n\n\n\n

    Frequently Asked Questions<\/h2>\n\n\n\n

    I lost my phone with the 2FA app on it. How do I log in?<\/strong><\/p>\n\n\n\n

    Log in using one of your backup codes. If you don't have any, temporarily rename the 2FA plugin folder via SFTP or File Manager wp-content\/plugins<\/code>, so that the plugin is disabled. If that doesn't work, please contact your hosting provider.<\/p>\n\n\n\n

    Which 2FA method is the most secure?<\/strong><\/p>\n\n\n\n

    An authenticator app or a hardware key. A free app like Google Authenticator or Authy works just fine. Email codes are only as secure as your email account, and text messages are the least secure option.<\/p>\n\n\n\n

    How many login attempts should I allow?<\/strong><\/p>\n\n\n\n

    A handful of temporary blocks per IP address is a good starting point. On Surver shared hosting, an IP address is blocked after more than ten failed login attempts, including on wp-admin<\/code>, automatically displays a CAPTCHA page.<\/p>","protected":false},"excerpt":{"rendered":"

    Je beveiligingsplugin of je host meldt ineens honderden mislukte inlogpogingen op je site, en je vraagt je af of je moet schrikken. Beveilig de WordPress-login met tweestapsverificatie, een limiet op inlogpogingen, een uniek beheerdersaccount zonder de naam admin, sterke wachtwoorden uit een wachtwoordmanager en waar mogelijk een gewijzigde inlog-URL of IP-beperking op wp-admin. Mislukte pogingen […]<\/p>\n","protected":false},"author":2,"featured_media":20525,"template":"","kennisbank_categorieen":[53],"class_list":["post-20420","kennisbank","type-kennisbank","status-publish","has-post-thumbnail","hentry","kennisbank_categorieen-beveiliging"],"acf":[],"_links":{"self":[{"href":"https:\/\/stage.surver.nl\/en\/wp-json\/wp\/v2\/kennisbank\/20420","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/stage.surver.nl\/en\/wp-json\/wp\/v2\/kennisbank"}],"about":[{"href":"https:\/\/stage.surver.nl\/en\/wp-json\/wp\/v2\/types\/kennisbank"}],"author":[{"embeddable":true,"href":"https:\/\/stage.surver.nl\/en\/wp-json\/wp\/v2\/users\/2"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/stage.surver.nl\/en\/wp-json\/wp\/v2\/media\/20525"}],"wp:attachment":[{"href":"https:\/\/stage.surver.nl\/en\/wp-json\/wp\/v2\/media?parent=20420"}],"wp:term":[{"taxonomy":"kennisbank_categorieen","embeddable":true,"href":"https:\/\/stage.surver.nl\/en\/wp-json\/wp\/v2\/kennisbank_categorieen?post=20420"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}