Check your server logs and you will find something slightly unsettling: a steady stream of login attempts against wp-login.php from addresses all over the world. It happens on brand new sites with no traffic. It has been happening on yours.
This is not evidence that someone is interested in your business. It is automated software working through a list. But it does mean WordPress login security is the highest-value protection most sites can add, because that page is where the most attempts land.
How the attacks actually work
Three approaches dominate, and they call for different defences.
Brute force tries password after password against a known username. Slow, noisy, and effective against weak passwords.
Credential stuffing uses real username and password pairs leaked from other services. Because people reuse passwords, a small percentage always work. Note that a strong password does not help here if you used it somewhere that got breached.
Password spraying tries a handful of very common passwords against many usernames. It is designed to stay under lockout thresholds, which is why simple attempt limits are not a complete answer.
What actually works
Two-factor authentication
If you do one thing, do this. Two-factor authentication makes a stolen or guessed password insufficient on its own. It defeats brute force, credential stuffing and password spraying simultaneously.
Use an authenticator app rather than SMS where you can. Apply it to every administrator, editor and shop manager account — not just yours.
Every other measure on this list reduces risk. Two-factor authentication removes an entire category of attack.
Rate limiting and lockouts
Limit failed attempts from an address, with an increasing delay. This makes brute force impractical. Combine it with a delay after each failure rather than a hard lockout, so an attacker cannot deliberately lock out your own accounts.
A firewall in front of WordPress
Better still is blocking the attempt before WordPress processes it at all. A firewall filters known-bad addresses and abusive patterns, saving both risk and server resources. On a heavily probed site this alone measurably reduces load.
Unique passwords, generated not invented
Long, random, unique per site, stored in a password manager. Human-invented passwords follow patterns that cracking tools already know. The main thing that matters is that the password is not reused anywhere else.
Fewer administrators
Every admin account is another way in. Most people who need dashboard access do not need full administrator rights — editor or author is usually enough.
Audit the user list quarterly. Old developers, former staff and agencies that finished a project years ago accumulate quietly.
What helps less than people think
Changing the login URL
Moving wp-login.php to a custom address cuts the volume of automated noise considerably, which is genuinely useful for server load. It is not a security control though — a determined attacker will find it, and it protects nothing if the password is weak.
Do it for the noise reduction, not as a substitute for real measures.
Hiding the admin username
Not using admin as a username is sensible. But WordPress leaks usernames in several places by default, so treat this as a small obstacle rather than a defence.
CAPTCHA
Reduces basic bot traffic and adds friction for real users. Modern attack tools handle many CAPTCHA implementations. Useful as one layer, not as the main one.
The part most sites miss: sessions
Login security does not end at the login. If someone gains access, they hold a session cookie until it expires.
Two practical measures. Set a reasonable session length rather than staying logged in for weeks. And after any suspected incident, regenerate the security keys in wp-config.php — this invalidates every existing session immediately, including the attacker's.
Changing passwords alone does not always log an intruder out. Regenerating the keys does.
Signs someone already has access
- Administrator accounts you did not create
- Password reset emails you did not request
- Content published or edited outside your working hours
- Plugin or theme settings changed with no explanation
- Successful logins in your security log from unfamiliar locations
- Your own account suddenly demoted or removed
If you see any of these, assume access is current. Change every password, regenerate the security keys, remove unknown accounts, and check for a backdoor — attackers rarely rely on the login once they are in. Our guide to removing malware from WordPress covers what to look for.
A sensible order to implement
- Two-factor authentication on every privileged account
- Unique generated passwords in a password manager
- Rate limiting on failed attempts
- A firewall filtering traffic before WordPress
- An audit of who has admin access
- Sensible session length
- Optionally, a custom login URL to reduce noise
The first two take an afternoon and deliver most of the benefit.
Why this is worth the effort
A compromised administrator account is the worst-case outcome. It is not a scanner finding a flaw in one plugin — it is full control: content, customer data, payment settings, and the ability to install a backdoor that survives your clean-up.
Compared with that, the inconvenience of an authenticator app is not much of a cost.
If you want it handled properly
Our security monitoring service includes a managed firewall, login protection, alerts on new administrator accounts, and prompt security updates — with a person reading the alerts rather than a dashboard nobody opens.
If you suspect someone already has access, do not wait. Our security and error fixing service can check properly. Send us your web address and we will tell you what we can see, usually the same day.
Get Shielded
We build, host, secure and monitor business websites — cleaning up hacks and keeping sites online for clients across the UK, USA, Australia and the UAE.
