How to Prevent WordPress Brute-Force Attacks: Complete Security Guide
WordPress websites are frequently exposed to automated login attempts. A brute-force attack occurs when an attacker repeatedly tries different usernames and passwords in an attempt to gain access to a WordPress account.
These attacks do not always mean that someone is specifically targeting your website. Automated bots can scan large numbers of websites and continuously test publicly accessible login endpoints.
The good news is that WordPress brute-force attacks can be significantly reduced by combining strong authentication, login rate limiting, two-factor authentication, firewall protection, secure hosting, monitoring, and regular maintenance.
This guide explains how brute-force attacks work and provides practical ways to protect a WordPress website.
What Is a WordPress Brute-Force Attack?
A brute-force attack is an automated attempt to gain access to an account by repeatedly trying different credentials.
A basic attack may look like:
admin / password
admin / 123456
admin / admin123
admin / password123
...More advanced attacks may use lists of previously leaked usernames and passwords.
The goal is usually to discover a valid combination:
Username + Password
↓
Successful Login
↓
Unauthorized AccessOnce an attacker obtains an administrator account, they may be able to change website settings, install malicious software, modify content, or access sensitive information.
Why WordPress Is Targeted by Brute-Force Bots
WordPress has predictable login endpoints, including:
/wp-login.phpand the administration area:
/wp-admin/Because these paths are common across WordPress websites, automated systems can easily identify and test them.
Attackers may also use:
- Stolen credential databases
- Common username lists
- Password dictionaries
- Previously compromised passwords
- Automated scanning tools
- Distributed IP addresses
This is why even a new or relatively small WordPress website can receive automated login attempts.
1. Use a Strong, Unique Password
One of the simplest defenses is using a strong password.
Avoid passwords such as:
password123
admin123
wordpress123
company123
12345678Instead, use a long, randomly generated password.
A password manager can help generate and store unique credentials.
Don’t Reuse Passwords
Never reuse your WordPress administrator password for:
- Hosting
- Domain registrar
- FTP/SFTP
- Other websites
- Database management
If another service suffers a credential leak, attackers may try the same credentials against your WordPress website.
2. Enable Two-Factor Authentication
Two-factor authentication, or 2FA, provides another layer of protection beyond the password.
Instead of:
Username + Passwordthe login process may require:
Username + Password
+
Additional authentication factorDepending on the solution, the second factor may involve:
- Authentication apps
- Security keys
- One-time codes
- Other supported verification methods
For administrator accounts, 2FA can make stolen passwords considerably less useful to an attacker.
3. Avoid Predictable Administrator Usernames
Using an obvious administrator username can make automated attacks easier.
For example:
admin
administrator
webmastercan be easier for attackers to guess than a unique username.
If your website already has an administrator account with a predictable username, create a replacement administrator account, verify it works, transfer content where necessary, and remove or downgrade the old account after confirming everything is correct.
Be careful when deleting users because WordPress may ask what should happen to their existing content.
4. Enable Login Rate Limiting
Rate limiting restricts how frequently a source can send login requests.
For example:
Normal traffic:
Request → Allow
Request → Allow
Request → Allow
Excessive traffic:
Request → Allow
Request → Allow
Request → Rate limitedThis can make automated password guessing significantly less efficient.
Rate limiting can be implemented through:
- WordPress security plugins
- Web application firewalls
- CDN/security platforms
- Hosting-level security
Choose limits that don’t unnecessarily block legitimate users.
5. Temporarily Block Repeated Failed Attempts
Another common technique is temporarily blocking a source after a certain number of failed login attempts.
For example:
5 failed attempts
↓
Temporary restriction
↓
Wait period
↓
Access restoredThe exact threshold and duration should depend on your website’s traffic and user behavior.
Avoid extremely aggressive settings that could lock out legitimate administrators.
6. Use CAPTCHA Where Appropriate
CAPTCHA can help identify automated login attempts.
It can be useful on:
- Login forms
- Registration forms
- Password reset forms
- Comment forms
However, CAPTCHA should complement other security measures rather than replace them.
A stronger setup combines:
CAPTCHA + 2FA + rate limiting + strong passwords
7. Protect the WordPress Login Page With a WAF
A Web Application Firewall can inspect requests before they reach your WordPress installation.
Depending on the provider, a WAF can help detect:
- Suspicious login traffic
- Automated requests
- Malicious request patterns
- Excessive traffic
- Known attack signatures
The traffic flow may look like:
Visitor
↓
WAF
↓
Security Rules
↓
Rate Limiting
↓
WordPressThis can prevent some unwanted traffic from reaching the origin server.
8. Use Cloudflare or a Similar Edge Security Service
A CDN and security platform can provide an additional layer between attackers and your hosting server.
Depending on the configuration, you may be able to use:
- Rate limiting
- WAF rules
- Bot controls
- DDoS protection
- Security challenges
- IP restrictions
For example, you could create targeted rules for excessive requests to:
/wp-login.phpDo not block legitimate login traffic accidentally. Test security rules carefully before applying restrictive policies to all users.
9. Use HTTPS
Always use HTTPS for WordPress authentication.
Your login page should look like:
https://example.com/wp-login.phprather than:
http://example.com/wp-login.phpHTTPS encrypts the connection between the browser and the website.
Make sure:
- SSL is valid
- HTTP redirects correctly
- WordPress URLs use HTTPS
- No major mixed-content problems exist
10. Keep WordPress Updated
Brute-force protection is only one part of WordPress security.
Keep current versions of:
- WordPress core
- Plugins
- Themes
- PHP
Security updates may address vulnerabilities that attackers could otherwise exploit after gaining access through another route.
Maintain backups before major updates and test the website afterward.
11. Remove Unused Plugins and Themes
Every installed plugin or theme represents software that needs maintenance.
Regularly remove software you no longer use.
This reduces:
- Maintenance requirements
- Potential attack surface
- Plugin conflicts
- Unnecessary code
Never keep an abandoned plugin installed simply because it is deactivated.
12. Protect the Password Reset Process
Attackers may target password recovery systems in addition to the login form.
Make sure the email account associated with your WordPress administrator is protected with:
- A unique password
- Two-factor authentication
- Account security alerts
If an attacker controls the administrator’s email account, they may be able to use password recovery functionality.
13. Secure WordPress Administrator Accounts
Limit the number of users with administrator privileges.
Review:
Dashboard → Users → All Users
Look for:
- Unknown users
- Unexpected administrators
- Old employee accounts
- Duplicate accounts
- Inactive privileged accounts
Remove or downgrade accounts that no longer need administrator access.
14. Follow the Principle of Least Privilege
Not every WordPress user needs administrator permissions.
Use the lowest role necessary.
For example:
| User Type | Appropriate Role |
|---|---|
| Site owner | Administrator |
| Content manager | Editor |
| Writer | Author |
| Contributor | Contributor |
| Basic registered user | Subscriber |
Reducing administrator accounts reduces the number of high-value accounts attackers can target.
15. Consider Changing the Login URL
Some security plugins can change the publicly accessible login path.
Instead of:
/wp-login.phpthe website may use a custom login address.
This can reduce automated attacks that blindly scan for the standard login endpoint.
However, changing the login URL is not a complete brute-force defense.
You should still use:
- Strong passwords
- 2FA
- Rate limiting
- WAF protection
- Monitoring
Think of a custom login URL as an additional layer rather than the main defense.
16. Protect wp-admin Carefully
The WordPress administration area uses:
/wp-admin/Do not simply block this directory for everyone because legitimate administrators need access.
Instead, consider:
- 2FA
- WAF protection
- Rate limiting
- VPN access for private administration
- IP restrictions where practical
- Strong account permissions
IP allowlisting can be useful for fixed office networks, but it may be inconvenient for administrators using mobile or changing networks.
17. Review XML-RPC Usage
WordPress provides XML-RPC functionality for certain integrations and remote operations.
It can also receive automated requests.
Determine whether your website actually requires it.
If you don’t need XML-RPC, consider disabling it through an appropriate configuration.
If you do need it, protect it rather than disabling it without checking dependencies.
18. Don’t Block the REST API Without Investigation
The WordPress REST API is used by many WordPress features.
It can support:
- The block editor
- Plugins
- External applications
- Mobile applications
- Integrations
Blocking the API globally may break legitimate functionality.
Instead, investigate suspicious API requests and apply targeted controls when appropriate.
19. Install a Reputable Security Plugin
A WordPress security plugin can combine several brute-force defenses.
Possible features include:
- Login attempt monitoring
- Rate limiting
- 2FA
- CAPTCHA
- Firewall rules
- IP blocking
- Malware scanning
- Security alerts
Avoid installing several plugins with overlapping firewall or login functionality unless you understand how they interact.
More security plugins do not automatically mean better security.
20. Monitor Failed Login Attempts
Security logs can reveal attack patterns.
Look for:
Repeated attempts
Multiple usernames
Same username attacked repeatedly
Large bursts of requests
Requests from many IP addresses
Unexpected geographic patternsFor example:
08:01 → admin → failed
08:01 → admin → failed
08:01 → admin → failed
08:02 → administrator → failed
08:02 → admin → failedA pattern like this is more meaningful than a single failed login.
21. Watch for Successful Logins From Unexpected Sources
A successful login can be more important than hundreds of failed attempts.
Monitor for:
- Unknown locations
- Unexpected devices
- Unusual times
- Unknown administrator accounts
If you see suspicious successful authentication:
- Change the password.
- Enable or verify 2FA.
- Review active sessions.
- Check administrator accounts.
- Review recent website changes.
- Inspect security logs.
- Investigate possible malware.
22. Protect Against Credential Stuffing
Brute-force attacks are not always random password guessing.
Credential stuffing uses usernames and passwords obtained from previous data breaches.
For example:
Email + Password
↓
Leaked elsewhere
↓
Tested against WordPressThe best defense is to use passwords that are:
- Unique
- Long
- Random
- Not reused
2FA adds another important layer.
23. Use a Password Manager
A password manager can make unique passwords practical.
Instead of remembering dozens of passwords, you can use the manager to generate and store them.
For example:
WordPress → Unique password
Hosting → Different password
Email → Different password
Domain → Different passwordThis greatly reduces the consequences of password reuse.
24. Disable Unnecessary User Registration
If your website does not need public user registration, consider disabling it.
Go to:
Settings → General
and review the membership settings.
If registration is necessary, protect it with:
- Email verification
- CAPTCHA
- Rate limiting
- Appropriate default roles
- Abuse monitoring
Never allow new users to register with administrator privileges.
25. Protect Login-Related Endpoints
Brute-force activity may involve more than just the standard login page.
Depending on your setup, review traffic involving:
/wp-login.php
/wp-admin/
/xmlrpc.php
/wp-json/Do not automatically block these paths.
Determine which endpoints your website needs and protect suspicious or abusive traffic with targeted rules.
26. Use Secure Hosting
Your hosting environment can provide additional protection.
When selecting WordPress hosting, consider features such as:
- Server firewalls
- Malware scanning
- Account isolation
- Secure backups
- SSL support
- Security monitoring
- Current PHP versions
Good hosting cannot prevent every brute-force attempt, but it can provide additional layers of protection around your WordPress installation.
27. Protect Your Hosting and Domain Accounts
An attacker does not necessarily need to compromise WordPress directly.
If they gain access to your hosting control panel or domain account, they may be able to modify your website or DNS.
Protect these accounts with:
- Unique passwords
- 2FA
- Limited access
- Security notifications
Your WordPress security strategy should cover the entire infrastructure.
28. Disable Dashboard File Editing When Appropriate
If administrators do not need to edit plugin or theme files from the WordPress dashboard, you can disable this feature.
A common configuration is:
define('DISALLOW_FILE_EDIT', true);This can reduce the ability to modify PHP files from the dashboard.
It does not replace server security or protect against an attacker who already has server-level access.
29. Use Backup and Recovery Protection
No security strategy is perfect.
Maintain backups of:
- WordPress files
- Database
- Uploads
- Configuration
Store important backups separately from the production website.
Test restoration periodically so you know the backup is usable.
A reliable recovery process reduces the potential impact of a successful compromise.
30. Avoid Aggressive IP Blocking
Blocking an IP address can be useful, but attackers can rotate addresses.
Modern automated attacks may originate from:
- Multiple networks
- Proxies
- Cloud infrastructure
- Compromised devices
- Distributed systems
Therefore, IP blocking should be one part of a broader strategy.
Combine it with:
2FA + strong passwords + rate limiting + WAF + monitoring
31. Use Login Protection on WooCommerce Websites
WooCommerce websites often have customer login and account functionality in addition to administrator authentication.
Protect:
- WordPress administrator accounts
- Customer accounts
- Password reset forms
- Registration
- Checkout-related authentication
Do not apply aggressive restrictions that prevent legitimate customers from accessing their accounts.
Test security rules against the complete customer journey.
32. Protect the Database
A successful WordPress account compromise can sometimes lead to attempts to access or manipulate other parts of the website.
Secure database access by:
- Using strong database credentials
- Restricting database access
- Protecting phpMyAdmin
- Keeping database software maintained
- Avoiding unnecessary public exposure
Never publish database credentials in publicly accessible files.
33. Monitor Server Resources
Large numbers of login requests can consume server resources.
Monitor:
- CPU usage
- Memory
- PHP workers
- Request volume
- Database connections
- Web server processes
If brute-force traffic is consuming significant resources, move some protection closer to the edge through a CDN, WAF, or hosting-level firewall when appropriate.
34. Use Security Alerts
Configure notifications for important security events where your security platform supports them.
Useful alerts may include:
- New administrator account
- Multiple failed logins
- Successful administrator login
- Plugin changes
- Theme changes
- File changes
- Malware detection
Do not create so many alerts that important warnings become easy to ignore.
35. What to Do During an Active Brute-Force Attack
If your website is receiving a large volume of login attempts:
Step 1: Confirm the Pattern
Check security and server logs.
Step 2: Enable Rate Limiting
Apply appropriate controls to login requests.
Step 3: Review Administrator Accounts
Make sure no unknown accounts have been created.
Step 4: Verify 2FA
Ensure administrator accounts are protected.
Step 5: Check Server Resources
Determine whether the traffic is affecting website performance.
Step 6: Use WAF Protection
If appropriate, add targeted rules for abusive traffic.
Step 7: Monitor the Website
Watch for suspicious successful logins, file changes, or configuration changes.
Do not panic simply because you see failed login attempts. The important question is whether the authentication system is resisting the attempts and whether any unauthorized login succeeded.
How to Know Whether Brute-Force Protection Is Working
After implementing security controls, monitor:
- Number of failed login attempts
- Number of blocked requests
- Successful administrator logins
- Server CPU usage
- Login response times
- Security events
- False positives
A useful security system should reduce abusive traffic without preventing legitimate users from logging in.
WordPress Brute-Force Protection Checklist
Authentication
- Strong unique passwords
- Passwords are not reused
- Two-factor authentication enabled
- Administrator accounts are limited
- Password manager used where appropriate
Login Protection
- Login rate limiting enabled
- CAPTCHA used where appropriate
- Failed attempts monitored
- Suspicious successful logins monitored
- Login endpoint protected
WordPress Maintenance
- WordPress updated
- Plugins updated
- Themes updated
- Unused plugins removed
- Unused themes removed
Infrastructure
- HTTPS enabled
- Hosting account protected
- Domain account protected
- WAF configured where appropriate
- Server resources monitored
Recovery
- Website backups available
- Database backups available
- Backups stored separately
- Restore process tested
Recommended Layered Protection
A practical WordPress brute-force defense can look like this:
Internet
↓
CDN / WAF Layer
↓
Bot Protection
↓
Rate Limiting
↓
HTTPS / TLS
↓
WordPress Login
↓
Strong Password
↓
2FA
↓
WordPress Dashboard
Each layer has a different purpose.
A firewall can reduce malicious traffic before it reaches the server, rate limiting can restrict excessive requests, strong passwords reduce credential guessing success, and 2FA can provide additional protection if a password is compromised.
Common Mistakes to Avoid
Relying Only on a Hidden Login URL
Changing the login URL can reduce automated scans, but it is not a replacement for strong authentication.
Using Weak Passwords
A login protection system cannot compensate for credentials that are easy to guess.
Disabling XML-RPC Without Checking Dependencies
Some websites still require XML-RPC functionality.
Blocking Every Bot
Some automated visitors are legitimate crawlers and services.
Blocking Large IP Ranges
Large-scale blocking can accidentally affect legitimate users.
Installing Too Many Security Plugins
Overlapping security features can create conflicts and complicate troubleshooting.
Ignoring Successful Logins
Failed login attempts are noisy. An unexpected successful administrator login deserves immediate attention.
Forgetting the Email Account
Password recovery can become an alternative route into an administrator account if the associated email account is poorly protected.
Final Thoughts
WordPress brute-force attacks are common because automated systems can repeatedly test publicly accessible authentication endpoints. However, receiving failed login attempts does not automatically mean your website has been compromised.
The goal is to make automated attacks difficult and inefficient while ensuring legitimate users can still authenticate normally.
Start with the essentials: strong unique passwords, two-factor authentication, updated WordPress software, limited administrator privileges, HTTPS, and login rate limiting.
Then add additional layers such as CAPTCHA, WAF protection, CDN-based security, login monitoring, server-level controls, and security alerts.
Finally, maintain reliable backups and regularly review your WordPress users, plugins, themes, hosting account, and security logs.
A layered security strategy is much more effective than relying on a single feature. By combining authentication security, traffic controls, monitoring, and recovery planning, you can substantially reduce the risk and impact of WordPress brute-force attacks.