Right now, while you’re reading this, automated bots are almost certainly trying to log into your WordPress site. They’re not targeting you specifically — they run continuously across millions of WordPress sites, trying common username and password combinations until something works.
WordPress’s default login page at /wp-admin or /wp-login.php is publicly accessible, allows unlimited login attempts, and is the same URL on every WordPress site in the world. That’s a known target with no default protection.
Three changes fix most of this. None of them require developer knowledge.
1. Limit Login Attempts
By default, WordPress allows unlimited failed login attempts. A bot can try ten thousand password combinations without any consequence. Limiting login attempts means that after a set number of failures — typically three to five — the IP address gets temporarily locked out.
The plugin we recommend is Limit Login Attempts Reloaded. Install it from the WordPress plugin directory, activate it, and the defaults are sensible out of the box: four attempts before a 20-minute lockout, with longer lockouts for repeat offenders.
In the plugin settings, make sure email notifications are enabled so you’re alerted when lockouts happen. A sudden spike in lockout notifications is an early warning that a targeted attack is underway.
2. Two-Factor Authentication
Limiting attempts slows bots down but doesn’t stop them entirely — especially if they’re patient or distributed across many IP addresses. Two-factor authentication (2FA) stops them completely, because even a correct password is useless without the second factor.
With 2FA enabled, logging in requires both your password and a time-sensitive code generated by an authenticator app on your phone — Google Authenticator, Authy, or similar. Even if someone knows your password, they can’t log in without physical access to your phone.
The plugin we use is WP 2FA by Melapress. After installation, go through the setup wizard, connect your authenticator app by scanning the QR code, and enable 2FA for all administrator accounts. The free version covers everything most sites need.
One important step: save your backup codes somewhere safe when the setup wizard offers them. If you lose access to your phone, backup codes are the only way to recover your account without developer intervention.
3. Change the Login URL
Every WordPress site in the world has its login page at /wp-login.php. Changing it to something non-standard means automated bots scanning for WordPress logins won’t find yours — they’ll get a 404 page instead.
This is security through obscurity, which means it’s not a substitute for strong passwords and 2FA — it’s a layer on top of them. But it dramatically reduces the noise in your login logs and the load on your server from bot traffic.
The plugin for this is WPS Hide Login. Install it, go to Settings → WPS Hide Login, and set a custom login URL — something specific to you that isn’t an obvious alternative like /login or /admin. Something like /your-team-name-access or a random string works well.
Critical: Write down the new URL and save it somewhere accessible before activating. If you forget it you’ll need FTP access to deactivate the plugin and restore the default URL.
Strong Passwords and User Roles
Two things worth checking while you’re hardening your login:
Passwords: Every administrator account should have a strong, unique password — not reused from any other service. WordPress has a built-in password generator in the user profile screen. Use it.
User roles: Go to Users and check that every account has the minimum role it needs. Editors don’t need Administrator access. Contributors don’t need Editor access. Every unnecessary Administrator account is an additional attack surface. Delete accounts that belong to people who no longer work with the site.
What This Looks Like in Practice
With all three measures in place — login attempt limits, 2FA on admin accounts, and a custom login URL — your WordPress login is meaningfully hardened against the vast majority of automated attacks. Bots can’t find the login page, and if they do, they get locked out after a few attempts, and even a correct password alone won’t get them in.
None of this takes more than 30 minutes to set up. For any site that collects customer data, processes payments, or has business-critical content, it’s 30 minutes that’s genuinely worth spending.
