How to Protect Your WordPress Login Page from Attacks

Right now, bots are probing your WordPress login page. That’s not paranoia — it’s the normal background noise of the internet. Automated scripts try thousands of username/password combinations against wp-login.php on every WordPress site they can find, hunting for weak credentials. Your login page is your site’s front door, and while WordPress’s lock is decent, most owners leave the door on a street where criminals are free to rattle it forever, unlimited times.

This guide layers the defences that actually stop login attacks: strong authentication, attempt limits, two-factor verification, and making the door harder to find — in the order a professional would apply them.

Quick Answer

To protect your WordPress login page from attacks: use a unique, strong admin password and a non-“admin” username, enable two-factor authentication, install a security plugin (like Wordfence) to limit login attempts and block brute-force bots, keep WordPress and plugins updated, and optionally change the login URL and add Cloudflare or CAPTCHA protection. Two-factor authentication plus login-attempt limits stop the overwhelming majority of real-world attacks.

How Login Attacks Actually Work

• Brute force: Bots try password after password — starting with the most common ones (“admin123”, your site’s name + year) — thousands of times, because by default WordPress allows unlimited attempts.
• Credential stuffing: Lists of email/password pairs leaked from other sites are tried automatically, because people reuse passwords. Your WordPress login falls not because it was guessed, but because your forum password from 2019 leaked.
• Username discovery: Attackers harvest usernames from author archives (?author=1 redirects), post bylines, and registration pages — then only the password stands between them and your site. That’s why “admin” as a username hands them half the puzzle for free.

The WordPress project’s own hardening WordPress guide puts login security at the centre of site security for exactly these reasons — it’s the attack surface every site exposes.

Defence 1: Credentials That Can’t Be Guessed or Stuffed

1. Kill the “admin” username: Create a new administrator account with an uncommon username, log in as it, then delete the old “admin” account (attributing its content to the new one).
2. Use a generated password: 16+ random characters, unique to this site, stored in a password manager. If you haven’t changed yours in a while, our guide on changing your WordPress admin password safely covers every method including lockout recovery.
3. Audit all accounts: Users → All Users. Delete accounts you don’t recognize (a red-alert sign of an existing compromise), and give every human the lowest role they need — most writers should be Editors or Authors, not Administrators.
4. Set a display name different from your username, so the name shown on posts isn’t the name used to log in.

Defence 2: Two-Factor Authentication (The Big One)

Two-factor authentication (2FA) requires a time-based code from an app on your phone in addition to the password. Even a stolen or guessed password becomes useless without your phone. Install a plugin that provides it — Wordfence Login Security (free) or the standalone Google Authenticator plugin:

1. Install and activate the 2FA plugin.
2. In your user profile, scan the QR code with an authenticator app (Google Authenticator, Microsoft Authenticator, Authy).
3. Save the backup/recovery codes somewhere safe and offline — they are your way back in if you lose the phone.
4. Require 2FA for all Administrator accounts at minimum.

If you do only one thing from this entire guide, do this one.

Defence 3: Limit Login Attempts and Block Bots

1. Install a security plugin — Wordfence (free) is the standard: enable its Login Security settings to lock out users after a handful of failed attempts (e.g. 5 tries → 1-hour lockout), and lock out anyone trying the username “admin” immediately.
2. Alternatively/additionally, a focused plugin like Limit Login Attempts Reloaded does this one job well.
3. Enable Wordfence’s firewall (it activates fully after a learning period) to block known attack patterns before they reach the login form.
4. Turn on the plugin’s login-activity alerts so you see attack waves — and successful logins — in your email.

Defence 4: Make the Door Harder to Reach

• Change the login URL: A plugin like WPS Hide Login moves wp-login.php to a custom address (e.g. /my-login). Bots hammering the default URL find nothing. (Keep the new URL somewhere safe — and note this is obscurity, a useful layer, not a substitute for Defences 1–3.)
• Add CAPTCHA: reCAPTCHA v3 or Cloudflare Turnstile on the login form filters automated attempts with minimal friction for humans. Wordfence and dedicated captcha plugins both offer this.
• Use Cloudflare: Its free plan can rate-limit and bot-check your login page at the network edge, before requests even reach your server. A targeted page rule for /wp-login.php and /wp-admin (with exceptions for your own AJAX needs) is a classic hardening move.
• Restrict by IP if you’re a fixed team: If all admins work from known addresses, your host or a plugin can allow wp-admin only from those IPs. Powerful, but brittle for travellers — use with care.

Defence 5: Keep the Whole House Maintained

Login hardening fails if attackers walk in through an outdated plugin instead. Keep WordPress, themes, and plugins updated (enable auto-updates for plugins), delete unused plugins and themes entirely, and run a backup schedule so even a successful attack is recoverable. Security plugins’ weekly scans and reports are worth the two minutes they take to read.

Common Mistakes to Avoid

• Relying on hiding the login page alone: Attackers also try XML-RPC and REST endpoints. Hidden URL plus no attempt limits plus no 2FA is a locked screen door.
• Locking yourself out with aggressive settings: When testing attempt limits or IP rules, keep a second admin session open and know your host’s file-manager route to disable a plugin (rename its folder) if you misconfigure.
• Ignoring “user registered” spam accounts: If your site doesn’t need public registration, turn it off (Settings → General → uncheck “Anyone can register”).
• Sharing one admin login across the whole team: When (not if) you need to revoke someone, shared credentials mean changing everyone’s access. Individual accounts, individual 2FA.
• Thinking a small site is too small to attack: Bots don’t know or care how small you are. They attack everything, automatically, all the time.

Conclusion

Protecting your WordPress login page is about layers: credentials that can’t be guessed or reused, two-factor authentication that makes stolen passwords worthless, attempt limits that end brute force, bot filters and a hidden door that cut the noise, and updates that close the side entrances. Set up 2FA and Wordfence today — thirty minutes of work — and the endless background rattle of bots against your door becomes exactly that: background noise, hitting a door that doesn’t open.

Frequently Asked Questions

What is a brute-force attack on WordPress?

It’s an automated attempt to log in by trying many username/password combinations rapidly. Default WordPress allows unlimited tries, which is why attempt-limiting plugins and two-factor authentication are so effective — they remove the attacker’s unlimited guesses.

Is changing my login URL enough to stop attacks?

No. It reduces automated noise dramatically, but attackers can still find or bypass the login through other endpoints. Combine a custom URL with strong passwords, attempt limits, and 2FA for real protection.

What’s the best free plugin to protect the WordPress login page?

Wordfence is the most complete free option: firewall, login attempt limits, and two-factor authentication in one plugin. Limit Login Attempts Reloaded is a good lightweight alternative focused purely on attempt limits.

Can two-factor authentication lock me out of my own site?

Only if you lose your phone AND your backup codes. Save the recovery codes the plugin gives you somewhere safe when you set 2FA up, and you’ll always have a way back in. Your host can also disable the plugin via the file manager in a true emergency.

Should I disable XML-RPC to protect my login?

XML-RPC is an older WordPress API that bots also use for login attempts. If you don’t use the WordPress mobile app or Jetpack features that need it, disabling it (via a security plugin) closes one more door. Wordfence blocks XML-RPC abuse either way.