Login & access
Protect wp-login, stop brute force, and lock down administrator access.
12 articles
WordPress login pages are probed constantly. Bots try common usernames and password lists against `/wp-login.php`, recycled credentials from other breaches, and any account that still has more privilege than it needs. You do not need to be a famous brand for this to happen. It is background noise on almost every public WordPress site.
Good login security is mostly boring work done well: strong unique passwords, fewer administrator accounts, two-factor authentication for people who can change the site, and limits on how many failed attempts an IP gets. Renaming the login URL will not stop a determined attacker, but it does cut a lot of automated guessing.
In Security Ninja Pro, login protection covers failed-login limits and a custom login URL, and two-factor authentication adds a second step for the roles that matter. Cloud Firewall can also apply country rules to login forms when you configure it that way.
Articles in Login & access
12 articles, newest first.
- An unknown WordPress admin: the calm response that keeps the incident short A client spotted an unrecognized administrator named wpmaint. How we contained access, checked plugins and themes, and left the site more disciplined than before.
- WordPress Login Security Guide 2026 Secure WordPress logins with strong passwords, 2FA, rate limits, fewer admins, optional login URL rename, and monitoring that catches abuse early.
- WordPress password protected categories for WooCommerce How WooCommerce Protected Categories (Barn2) restricts products by password, role, or user, plus security caveats and store hardening that still matter.
- Password Management Tips for WordPress Sites Practical password habits for WordPress: unique admin passwords, managers, 2FA, shared access, and where login protection fits.
- Phishing threats on WordPress: email scams vs a compromised site How WordPress phishing shows up as fake emails versus malware on your site, how to spot both, clean up safely, and harden logins with MFA.
- WordPress user roles explained: access, permissions, and safer assignments What each WordPress user role can do, how capabilities work, and how to assign the least access that still gets the job done.
- Access control in database security How database access control works: least privilege, discretionary vs mandatory models, flow and inference controls, and why it matters for WordPress data.
- Password protect your entire WordPress site, posts, and categories How to password protect a whole WordPress site with a plugin, lock individual posts and pages in the block editor, and restrict categories when you need gated content.
- Phishing guide: spot fake emails before they cost you How phishing works, how to spot fake emails and links, and simple habits that keep WordPress logins and business accounts safer.
- Admin Password Trends Since 2012: Prioritizing Password Strength and Security Why weak WordPress admin passwords still get sites owned, and how to fix it with unique passwords, a password manager, and 2FA.
- Emergency WordPress admin recovery with a one-time URL hook Authorized emergency recovery when you have file access but no admin login: a temporary one-time URL hook, then remove the code immediately.
- Create a WordPress admin user via FTP when you are locked out Recover a locked WordPress site by temporarily adding a known-safe admin account through FTP or file manager, then remove the code immediately.
If staff or clients share passwords, or old freelancer accounts are still active, fix that before stacking more plugins. Access control is as much about people and roles as it is about rate limits.
After hardening logins, review who can install plugins and edit files. Then keep an eye on Events so repeated failures and blocks are visible instead of silent.
Need the product path? Start with login protection and 2FA, or read the complete login security guide first.