If your WordPress site is online, bots are already trying to guess your password. Brute-force attacks against wp-login.php are constant, automated, and cheap to run. The good news: a layered defense stops them cold without much effort.
How Brute-Force Attacks Work
Attackers run scripts that submit thousands of username and password combinations against your login page. They target common usernames like “admin” and leaked password lists. A successful guess hands them full control, so even a low success rate is worth their time at scale.
Detecting an Attack
Signs in Your Logs
- Repeated POST requests to wp-login.php from one or many IPs
- Spikes in failed login notifications
- Sudden CPU or database load from login processing
Server access logs are your clearest signal. A flood of 200 and 401 responses on the login endpoint is a dead giveaway.
Real Defenses That Work
1. Limit Login Attempts
Rate limiting is the single most effective defense. After a handful of failed attempts, lock the IP out for a while. Plugins like Limit Login Attempts Reloaded handle this, or your host may offer it at the server level.
2. Enforce Two-Factor Authentication
Even if an attacker guesses the password, 2FA stops them at the second factor. This single measure neutralizes the entire category of credential-guessing attacks.
3. Rename or Protect the Login Page
Moving wp-login.php to a custom URL hides it from generic bots. Pair this with HTTP authentication on the login page for a second wall attackers must pass first.
4. Use Strong, Unique Passwords
Long passphrases defeat dictionary attacks. Ban weak passwords and never reuse credentials across sites.
Block at the Edge
A web application firewall, whether through a service like Cloudflare or a plugin like Wordfence, can drop malicious login traffic before it touches PHP. Edge blocking conserves server resources and stops attacks earlier in the chain.
Hardening the Login Flow
- Disable XML-RPC if you don’t use it; it’s a common brute-force vector
- Never use “admin” as a username
- Add a CAPTCHA to the login form to defeat simple bots
- Disable user enumeration so attackers can’t harvest usernames
Monitoring and Response
Set up alerts for repeated failed logins so you know when you’re under sustained attack. Keep daily backups so that even a worst-case breach is recoverable. A security plugin’s activity log helps you trace what happened and when.
Final Thoughts
Brute-force attacks are inevitable, but successful ones are not. Limit attempts, enforce 2FA, hide and harden the login page, and block at the edge. Layer those defenses and the constant background noise of guessing bots becomes a non-event for your site.