How to Secure Your WordPress Login from Brute-Force Attacks

A brute-force attack is when bots try thousands of username and password combinations against your login page, hoping to guess their way in. WordPress is a favourite target simply because it is everywhere. The good news: a handful of straightforward measures make your login practically un-guessable.

Step 1: Use strong, unique credentials

Never use "admin" as your username, and use a long, unique password — see creating strong passwords. Most attacks rely on common combinations; a strong password defeats them outright.

Step 2: Limit login attempts

By default WordPress allows unlimited tries. A "limit login attempts" plugin locks out an IP after a few failures, which stops brute-force bots cold. This single change blocks the vast majority of automated attacks.

Step 3: Add two-factor authentication

With 2FA, even a correct password is not enough without the second code. Add it with a plugin, and enable it on your hosting account too — see enabling 2FA in cPanel.

Step 4: Protect the login page itself

Password-protect wp-admin at the server level so bots never reach the login form — see password-protecting a directory.
Block persistent attacker IPs — see blocking an IP in cPanel.
Let ModSecurity help — see ModSecurity in cPanel.

Step 5: Keep everything updated

Brute force is one route in; outdated software is another. Keep WordPress, themes and plugins current so known holes stay closed. A CDN like Cloudflare can also filter malicious login traffic before it reaches you.

Frequently asked questions

Should I change my login URL?

Hiding wp-login.php behind a custom URL reduces automated noise, though it is not a substitute for strong passwords and limited attempts. Treat it as a helpful extra layer, not the main defence.

My site slows down during attacks. Why?

Each login attempt consumes resources, so a heavy brute-force run can strain your account. Limiting attempts and blocking the source IPs cuts that load — and a CDN absorbs much of it upstream.

I think they already got in.

Act fast: change all passwords, and scan and clean the site — see recovering a hacked WordPress site.