To secure your WordPress login, use long unique passwords, turn on two-factor authentication, limit repeated login attempts and get rid of the “admin” username. Then switch off XML-RPC if you don’t use it, cut back admin accounts and add protection at the server or firewall. Together these stop the automated password-guessing that hits almost every WordPress site.
Key takeaways
- Bots try passwords on WordPress logins all day. Wordfence blocked more than 55 billion of these attempts in 2024.
- Strong unique passwords and two-factor login do most of the work. Start there.
- Rate-limiting at the server or firewall beats a plugin alone, because attacks are stopped before they reach WordPress.
- Changing the login URL cuts noise, but it isn’t real protection on its own.
Why is the WordPress login page attacked so often?
Every WordPress site has a login page in the same place, usually /wp-login.php. That makes it easy for bots to find and try password after password. Wordfence blocked more than 55 billion password attacks on WordPress sites in 2024 (Wordfence).
Most of these attacks aren’t aimed at you personally. They’re automated, cheap and constant. One guessed or leaked password gives the attacker full control of your site, which is why the login deserves its own checklist. For the bigger picture, see our guide to small business cyber security in Australia.
Which 8 settings protect a WordPress login?
WordPress’s own guidance on brute-force attacks covers most of these (WordPress Developer Resources). Here they are in order of impact.
1. Use long, unique passwords
Australia’s cyber security agency, ASD, recommends passwords of at least 15 characters, made from a random mix of unrelated words, and different for every account (cyber.gov.au). A password manager makes that practical. Reused passwords are the real danger: if one site leaks yours, bots will try it on your WordPress login.
2. Turn on two-factor authentication
A code from your phone means a stolen password isn’t enough. WordPress core doesn’t include it, so you add it with a plugin. Our guide to WordPress two-factor authentication explains which method to choose and how to roll it out without lockouts.
3. Limit login attempts
Slow down anyone who gets the password wrong again and again. A security plugin can do this, but WordPress’s guidance prefers rate-limiting at the firewall or web server. Plugins still run inside WordPress, so a heavy attack uses up server resources even when it fails.
4. Get rid of the “admin” username
“admin” is the first username bots try. WordPress’s guidance is simple: don’t use it. Create a new administrator with a less obvious username, log in as that user, then delete the old account and give its posts to the new one. Also set each user’s public display name to something other than their login name.
5. Switch off XML-RPC if you don’t use it
XML-RPC is an older way for apps to talk to WordPress, through a file called xmlrpc.php. Attackers use it to try passwords as well. WordPress advises disabling it if you don’t need it. Check first: some plugins, such as Jetpack, and the WordPress mobile app may rely on it.
6. Have fewer administrators
Every admin account is another login that can be guessed or leaked. Give staff the lowest role that lets them do their job: Editor for content, Shop Manager for orders. Remove accounts for people who’ve left. Our guide to website access management sets out a simple routine.
7. Protect the login at the server or firewall
A web application firewall can block bad traffic and rate-limit the login before WordPress even loads. Some sites also add an IP allowlist or an extra password on wp-login.php at the server. Test these carefully: WordPress warns that blocking all of /wp-admin can break plugins. This layer is part of what good secure web hosting should give you.
8. Consider changing the login address
Moving the login to a custom address cuts the number of bot attempts in your logs. WordPress notes it can reduce noise but shouldn’t be your only defence. Write the new address down, because a forgotten login URL is a common way to lock yourself out.
Which should I do first?
| Setting | Effort | Impact |
|---|---|---|
| Long, unique passwords | Low, with a password manager | High |
| Two-factor authentication | 15 minutes per person | High |
| Limit login attempts | Low | High |
| Remove “admin” username | 10 minutes | Medium |
| Disable XML-RPC if unused | Low, but check first | Medium |
| Fewer administrators | Low | Medium |
| Server or firewall protection | Needs your host or developer | High |
| Custom login address | Low | Low |
If you only have half an hour, do passwords, two-factor login and login limits today. Take a backup and make sure you can reach your hosting file manager before you change anything. If you do lock yourself out, our guide for when you can’t log in to WordPress will get you back in.
Is a locked-down login enough?
No. A strong login stops password attacks, but plenty of hacks come through vulnerable plugins instead. Patchstack found that 91% of new WordPress vulnerabilities in 2025 were in plugins (Patchstack). A trusted plugin can even turn malicious after an update, as our article on a plugin supply chain attack explains. Updates, scanning and backups matter just as much.
That’s where our website security monitoring comes in. Every Maintain & Protect plan includes a security lockdown at setup, firewall and login protection, and daily malware scans. Advantage and Elite add two-factor login and advanced firewall rules. Compare the levels on our website maintenance plans page.
Frequently asked questions
Should I change my wp-admin URL?
It’s optional. A custom login address reduces bot traffic and clutter in your security logs, but it doesn’t stop a determined attacker. Do it after strong passwords, two-factor login and login limits, not instead of them. Keep a record of the new address.
How many login attempts should I allow?
A common setting is a short lockout after three to five failed attempts, getting longer if failures continue. That’s generous for real people who mistype, and slow enough to make guessing pointless. Lockouts at the firewall or server are better than in WordPress itself.
Is it safe to disable XML-RPC?
For most small business sites, yes. Check first whether you use Jetpack, the WordPress mobile app or a tool that publishes to your site remotely. If you do, ask your host to restrict and rate-limit XML-RPC instead of switching it off.
Do I need a security plugin to protect my login?
Not always. Your host’s firewall may already rate-limit logins and block known bad traffic. You’ll still need a plugin for two-factor authentication, because WordPress doesn’t include it. Avoid running two plugins that both try to manage logins.
How do I know if someone is trying to break into my login?
A security plugin or your host’s firewall logs will show failed login attempts, often thousands a day. That’s normal background noise. Worry if you see a new admin user you didn’t create, or a successful login from an unfamiliar location.
Sources
- Brute Force Attacks, WordPress Developer Resources
- 2024 Annual WordPress Security Report, Wordfence, April 2025
- Personal cyber security handbook: Use unique and strong passwords, Australian Signals Directorate, 7 October 2026
- State of WordPress Security in 2026, Patchstack, 2026