Login protection
Definition
Login protection is the set of controls that harden the WordPress login against bots and credential attacks.
Also called: login hardening, protect WordPress login
Why it matters for WordPress
wp-login.php is the front door on almost every site. Bots do not care how small your blog is. Real protection is rate limits, lockouts, 2FA, and watching successes after failure spikes. Renaming the login URL alone is security theater.
How it shows up in practice
- Failed-login charts that climb, then flatten once limits kick in
- Lockout notices for noisy IPs while staff still get in with 2FA
- Quiet successful logins from stuffed passwords when 2FA was never required
- XML-RPC or REST auth attempts that bypass a “pretty” custom login slug
What to do
- Unique passwords plus 2FA for Administrator and Editor.
- Rate-limit failures and review the log after unusual spikes.
- Restrict XML-RPC if nothing you run needs it.
- Treat a surprise admin login as an incident until proven otherwise.
In WP Security Ninja
Login protection handles attempt limits and related lockouts. 2FA covers privileged roles so a guessed or stuffed password is not enough on its own. The full walkthrough lives in the WordPress login security guide.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- Brute force A brute-force attack tries many passwords or tokens until one works, usually against the login form.
- Two-factor authentication (2FA) Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
- Rate limiting Rate limiting caps how often an action can happen from an IP or account, which slows automated abuse.
- Credential stuffing Credential stuffing replays usernames and passwords stolen from other breaches against your login.
- XML-RPC XML-RPC is an older WordPress API endpoint attackers often abuse for brute force and amplification.
- Account takeover Account takeover is when an attacker gains control of a legitimate user account and can act as that user.
