Quick answer
Secure your WordPress login by using strong, unique passwords, enabling two-factor authentication, limiting login attempts, avoiding the 'admin' username, and adding a firewall or Cloudflare rule to block brute-force traffic. Optionally, change the login URL and add HTTP authentication to the wp-login.php page for another layer.
Key takeaways
- The login page is the single most attacked part of any WordPress site.
- Two-factor authentication and limited login attempts stop most brute-force attacks.
- Strong, unique passwords and avoiding 'admin' close the easiest doors.
Your WordPress login page is under near-constant automated attack. Bots try thousands of username and password combinations hoping to get lucky. The good news: a handful of practical steps stop almost all of it.
Use strong, unique passwords
Every account — especially admins — should have a long, unique password stored in a password manager. Reused or weak passwords are the number one way sites get breached.
Enable two-factor authentication
This is the highest-impact step. Even if a password leaks, an attacker can't log in without the second factor from your phone or authenticator app.
Limit login attempts
Cap failed logins so bots can't try endlessly. After a few failures, the account or IP is temporarily locked, which defeats brute-force attacks.
Avoid the 'admin' username
If half the login guess is already known, you've made the attacker's job easier. Use a unique admin username instead.
Block attacks before they arrive
A firewall or a Cloudflare rule can filter malicious login traffic before it reaches WordPress at all. Optionally, hide or password-protect the login page for another layer.
Free security check
Worried your site is infected?
Get a free security assessment — I'll tell you if your WordPress site is compromised and exactly what it needs. No obligation.
Follow-up questions
People also ask
It reduces automated attacks by hiding the default wp-login.php, but it's not a substitute for strong passwords and two-factor authentication. Treat it as one extra layer.
Keep reading
How to Recover Your Google Rankings After a Hack
A hack can tank your search rankings. Here's how to recover them once the site is clean.
WordPress Security for Small Businesses: A Practical Guide
You don't need an IT team to secure a small-business WordPress site. Here's a practical, no-jargon plan that covers the essentials.
How to Secure a WooCommerce Store
A WooCommerce store handles money and customer data, which makes it a target. Here's how to secure it without hurting sales.