---
title: Login protection
canonical: https://wpsecurityninja.com/dictionary/login-protection/
---
# Login protection

Login protection is the set of controls that harden the WordPress login against bots and credential attacks.

[Full guide](https://wpsecurityninja.com/wordpress-login-security-complete-guide/)

## Why it matters for WordPress

`wp-login.php` is the front door on almost every site. Bots do not care how small your blog is. Real protection is rate limits, lockouts, 2FA, and watching successes after failure spikes. Renaming the login URL alone is security theater.

## How it shows up in practice

- Failed-login charts that climb, then flatten once limits kick in
- Lockout notices for noisy IPs while staff still get in with 2FA
- Quiet successful logins from stuffed passwords when 2FA was never required
- XML-RPC or REST auth attempts that bypass a “pretty” custom login slug

## What to do

1. Unique passwords plus 2FA for Administrator and Editor.
2. Rate-limit failures and review the log after unusual spikes.
3. Restrict XML-RPC if nothing you run needs it.
4. Treat a surprise admin login as an incident until proven otherwise.

## In WP Security Ninja

[Login protection](https://wpsecurityninja.com/login-protection/) handles attempt limits and related lockouts. [2FA](https://wpsecurityninja.com/two-factor-authentication-2fa/) covers privileged roles so a guessed or stuffed password is not enough on its own. The full walkthrough lives in the [WordPress login security guide](https://wpsecurityninja.com/wordpress-login-security-complete-guide/).