How to Protect wp-login.php From Brute-Force Attacks

If you have a WordPress site, someone — more precisely some bot — is probably trying to log in to your admin page right now. It is not personal: automated programs continuously scan the internet and try thousands of username and password combinations on every WordPress site. This is called a brute-force attack, and the target is almost always the same address: your-site.com/wp-login.php. The good news is that the defence comes down to a few concrete steps.

Why wp-login.php is a target

WordPress powers a huge part of the internet, so attackers know the login address will almost always be in the same place. If they guess the password, they gain full control of the site — they can inject malware, redirect visitors or steal data. The attack does not even have to succeed to hurt you: thousands of attempts per minute load the server and slow the site down for real visitors.

Limit the number of login attempts

The first and most important step is limiting attempts. By default WordPress allows an unlimited number of login attempts, which is a gift to bots. A login-limit plugin (or a feature built into a security plugin) blocks an IP address after, say, 5 failed attempts for 15 minutes. This effectively stops automated attacks because the bot cannot try thousands of combinations.

Enable two-factor authentication

Even if an attacker guesses the password, two-factor authentication (2FA) requires a second step — a code from an app on your phone. Without that code, the login fails. This is one of the most powerful protections and is worth enabling for every administrator. We explained it in detail in our guide to two-factor authentication for site owners.

Use strong, unique passwords

Brute-force attacks first try the most common passwords: "admin123", "password", the company name and so on. A long, random password of 16+ characters makes guessing practically impossible. Never reuse the same password in multiple places. We wrote about how to maintain this easily in the article on strong passwords and password managers.

Additional layers of protection

• Change the default username: never use "admin" as a username — that is half the work done for the attacker.
• Hide or rename the login page: moving the login from /wp-login.php to a custom address deflects the vast majority of automated bots.
• CAPTCHA on login: a simple check that a bot struggles to pass.
• WAF at the server level: a firewall that recognises and blocks attacks before they even reach WordPress.

All of this is part of the wider security picture we summarised in the guide 9 steps to secure WordPress. If you want attacks stopped before they reach your site, quality hosting with WAF/DDoS protection matters too.

Frequently asked questions

Do I need a plugin or is host protection enough? Ideally both. Host WAF catches attacks at the server level, while a plugin adds attempt limiting and 2FA at the WordPress level. Together they cover every layer.

Will protection lock me out of my own site? If you enter the wrong password several times you may be temporarily blocked, but the block usually lasts a short time and you can always regain access via the hosting panel or by resetting the password.

How often do these attacks happen? Continuously. A new site often gets its first login attempts within a few hours of going live, which is why protection should be set up immediately.

For a site protected from day one, take a look at our hosting plans with WAF/DDoS protection or read more about WordPress hosting.