Stop Brute Force Attacks on Your WordPress Login — Before It’s Too Late
Back in 2011, I was working through vWorker — the old freelance platform that eventually became Freelancer.com — and a client came to me with a Joomla 1.5 site that had gone completely offline. Shared hosting, cPanel, the whole setup. His host had suspended the account because a botnet was hammering the admin login thousands of times an hour and the server load was tanking other accounts on the same machine. I’d never seen raw access logs that long. Scrolling through them was genuinely unsettling — the same IP blocks, cycling through username and password combinations like a machine, because it was a machine.
Here’s what I did wrong: I focused entirely on the Joomla site and completely ignored the WordPress blog sitting in a subdirectory at /blog/. Same server. No protection on wp-login.php. A week later, that WordPress install had three new admin users I hadn’t created, and there was a mailer script buried in wp-content/uploads/2011/03/ named something like image_resize.php. That experience is why, to this day, I lock down the login on every WordPress site before I do anything else. Every single one.
Why Your Login Page Is Such an Easy Target
WordPress powers somewhere around 43% of the web. That’s not a small number. It means attackers can write one script, point it at /wp-login.php, and run it against millions of sites without changing a single line of code. Your site doesn’t need to be famous or profitable — it just needs to exist.
The bots aren’t trying to guess your specific password either. They’re running credential lists — leaked username/password combinations from other breaches, common passwords, variations of your domain name. They’re fast and they’re cheap to run. A basic brute force campaign can try thousands of combinations in minutes, and on a standard WordPress install with no wp-login protection in place, nothing stops them from trying.
I’ve cleaned sites where the attacker got in through a weak admin password after months of quiet attempts that the site owner never noticed because nothing was logging it. No alerts, no lockouts, no record. Just a successful login one Tuesday afternoon and a pharma hack quietly growing in the theme files. If you’ve ever had something like that, WordPress Pharma Hack: Step-by-Step Cleanup covers what to do.
The Fixes That Actually Work — My Real Stack
I don’t recommend the same solution to every client. A small photography portfolio on shared hosting needs a different setup than a WooCommerce store doing $50k a month. But there’s a core set of things I apply almost universally, and I’ll walk through them honestly.
Limit Login Attempts
This is the first thing. The plugin I reach for is Limit Login Attempts Reloaded — free, lightweight, does exactly what it says. After a set number of failed attempts from the same IP, it locks that IP out for a period you configure. I usually set it to 3 attempts, then a 20-minute lockout, then a longer lockout on repeat offenders. You can also get this behaviour through Wordfence if you’re already running it, and I usually am. The point is that without some form of limit login attempts control, your site will just sit there absorbing hits forever.
Change the Login URL
Hiding wp-login.php behind a custom URL won’t stop a determined attacker — I want to be clear about that. It’s not security through obscurity in the “this solves the problem” sense. But it does eliminate the vast majority of automated bots that are just targeting the default path. Changing the WordPress login URL with something like WPS Hide Login drops the login-related traffic on my clients’ sites dramatically, almost immediately. One client in Melbourne saw her server load cut by about 30% within 48 hours just from this one change. Worth doing. Not a silver bullet, but worth doing.
Two-Factor Authentication
This is where I push back a little on clients who resist it. I understand it feels like friction. But wordpress two factor authentication is, honestly, the single most effective thing you can add to an admin account short of restricting login by IP address entirely. Even if your password is compromised, the attacker can’t get in without the second factor. I use the WP 2FA plugin for most clients — it’s straightforward, supports authenticator apps, and has a setup wizard that even non-technical users can follow. Done. No excuses.
Block xmlrpc.php
This one catches people off guard. XML-RPC is an old API endpoint in WordPress that legitimate tools like Jetpack and some mobile apps use, but it’s also a favourite target for xmlrpc attacks on WordPress because it allows multiple authentication attempts in a single request — effectively bypassing lockout plugins. If you’re not using any service that needs XML-RPC, the cleanest fix is to block it entirely at the server level.
# Block xmlrpc.php — add to .htaccess
<Files xmlrpc.php>
Order Deny,Allow
Deny from all
</Files>If you do need XML-RPC for Jetpack or similar, Wordfence has an option to allow legitimate XML-RPC requests while blocking the brute force patterns specifically. That’s the configuration I use in those cases.
The Thing Most People Skip: Actually Watching the Logs
You can install every plugin on this list and still get compromised if you never check what’s happening. Wordfence sends email alerts — read them. The free version is enough for most small sites, and it will tell you when logins are being attempted, which usernames are being targeted, and where the traffic is coming from. I’ve had clients come to me months after a breach who had ignored a dozen Wordfence alert emails because they looked “spammy.” They weren’t.
If your site is already showing signs of something wrong — redirects, strange content appearing, Google flagging it — the stop brute force attacks on WordPress login conversation is secondary to cleanup. Start with Your WordPress Site Got Hacked. Do This First. and then come back and lock things down properly once the site is clean. Hardening a compromised site without cleaning it first is like changing the locks while someone’s still inside.
The login page is the front door. Prop it open and eventually someone walks in. It doesn’t take long and it doesn’t take sophistication — just patience, automation, and one weak password or one unprotected endpoint you forgot about.
If you’d rather have someone else handle this properly, I take on WordPress security work regularly through swsDreams — just get in touch and I’ll take a look at what your site actually needs.
