WordPress Brute-Force Protection: Lock Down wp-login.php
Brute-force and credential-stuffing attacks hammer wp-login.php around the clock — automated bots trying common and leaked passwords against your admin. They're noisy, they waste resources, and they occasionally succeed. Here's how to lock the login down so they don't.
See what's exposed: run a free MageArgus scan to check your login surface, headers and version leaks.
- wp-login.php and XML-RPC are among the most-attacked endpoints on the web — Wordfence attack data
- 2FA defeats credential stuffing even when a password is already leaked — OWASP
Limit login attempts
The single most effective control: lock out an IP after a few failed attempts. A limit-login plugin or your WAF does this. It turns an unlimited guessing game into a handful of tries, which stops brute force cold.
Enforce two-factor authentication
Even a correctly-guessed password fails without the second factor. Require 2FA (TOTP app or hardware key) for every administrator — this is the strongest single defence against credential stuffing.
Protect or move wp-login.php
Reduce exposure by rate-limiting, adding a CAPTCHA, or restricting wp-login.php by IP where practical:
# nginx: rate-limit the login
limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;
location = /wp-login.php { limit_req zone=login burst=3 nodelay; }Renaming the login path adds mild obscurity but isn't a substitute for the controls above.
Disable XML-RPC if unused
XML-RPC allows amplified brute force (many credentials per request) and can be abused for DDoS. If you don't use the Jetpack/mobile app features that need it, disable it:
# nginx: location = /xmlrpc.php { deny all; }Strong, unique passwords
No shared or reused admin passwords, and no user literally named admin. Use a password manager and require length over complexity. Pair with the wider security checklist and wp-config hardening.
Frequently asked questions
Do I need a plugin, or can the server handle it?
Either works. A plugin is quickest for limiting attempts and adding 2FA/CAPTCHA; a server-level rate limit (nginx/Apache or a WAF) is more efficient and protects XML-RPC too. Many sites use both — server rate-limiting plus a 2FA plugin.
Is renaming wp-login.php enough?
No. It cuts down automated noise but is only obscurity — determined attackers find the login. Combine it with attempt-limiting and 2FA, which are the controls that actually stop brute force.