Why Login Security Matters
Over 90% of hacking attempts target the WordPress login page. Brute force bots try thousands of username and password combinations every minute. If your login security is weak, it is only a matter of time before attackers get in.
Change the Default Login URL
The default WordPress login is at /wp-login.php or /wp-admin/. Every attacker knows this. Change it to a unique URL using the WPS Hide Login plugin. This single change blocks the vast majority of automated attacks.
Use Strong, Unique Usernames
Never use "admin" as your username. It is the first combination attackers try. Create admin accounts with unique usernames that are not guessable. Avoid using your name, business name, or email as the username.
Password Requirements
Enforce strong passwords with these minimum requirements:
- 16+ characters in length
- Mix of uppercase and lowercase letters
- At least 2 numbers
- At least 2 special characters (!@#$%^&*)
- No dictionary words or common patterns
- Unique - not used on any other site
Use a password manager like Bitwarden (free) or 1Password to generate and store strong passwords.
Two-Factor Authentication
2FA is the single most effective login security measure. Even if a hacker gets your password, they cannot log in without the second factor. Enable 2FA using:
- Google Authenticator app (free)
- Authy app (free, with backup)
- WP 2FA plugin for WordPress
Limit Login Attempts
By default, WordPress allows unlimited login attempts. This enables brute force attacks. Limit to 5 attempts per 15 minutes using Wordfence or a dedicated plugin. Lock out users who exceed the limit for 15-30 minutes.
Disable XML-RPC
XML-RPC is a WordPress API that can be exploited for brute force attacks. If you do not use it (most sites do not), disable it through your security plugin or .htaccess rules.
Monitor Login Activity
Review login logs regularly for suspicious activity:
- Login attempts from unusual locations
- Failed login attempts in rapid succession
- Logins at unusual times
- Multiple failed attempts followed by a success (may indicate compromised credentials)
Set Session Expiration
Configure WordPress to automatically log out inactive users after 48 hours. This prevents unauthorized access if someone leaves a computer logged in. Most security plugins include this feature.
The Complete Login Security Setup
- Change login URL from /wp-login.php
- Use unique admin usernames
- Enforce 16+ character passwords
- Enable two-factor authentication
- Limit login attempts to 5 per 15 minutes
- Disable XML-RPC if not needed
- Monitor login activity weekly
Implementing all seven measures takes about 30 minutes and provides comprehensive login security.