Securing the WordPress Login: 2FA, Login Limits and a Custom Login URL

The login page is the most frequently attacked part of a WordPress install – automated bots try usernames and passwords around the clock. The good news: a few measures make this attack route practically useless, without cluttering your site with plugins.

1. Two-Factor Authentication (2FA)

The most effective single measure. Even if a password is cracked or leaked, the attacker is missing the second factor – a time-based code from an authenticator app like Google Authenticator or Aegis. 2FA comes as a lean plugin; enable it at least for all administrator accounts, better for anyone who can log in. When setting it up, store the recovery codes somewhere safe so you don’t lock yourself out.

2. Limit Login Attempts

Brute-force attacks rely on being able to try indefinitely. A login limit locks the IP for a while after a few failed attempts – and makes mass guessing pointless. Many security plugins include this. Don’t set the lock too aggressively, so legitimate users don’t get permanently locked out after a typo.

3. Strong, Unique Passwords

Sounds obvious, but it’s the foundation. Every admin account gets a long, unique password from a password manager. And: delete the default username “admin” – it’s half the battle for any attacker, because then they only have to guess the password. Instead, create a new admin with its own name, transfer the content and remove “admin”.

4. Keep an Eye on xmlrpc.php

An often-overlooked side entrance: the xmlrpc.php file lets attackers try hundreds of passwords in a single request – brute force at high speed. If you don’t use services that need XML-RPC (some app integrations, for example), access to it can be blocked. Many security plugins offer a switch for this.

5. Obscure the Login URL (Optional)

Moving the login page from /wp-login.php to a custom address keeps most automated bots away. It’s not real security (security by obscurity), but it noticeably reduces load from bot requests. Useful as an addition, not a replacement for 2FA and a login limit.

6. Keys and Constants

Reset the security keys in wp-config.php (this invalidates stolen sessions) and disable the in-dashboard file editor, so a compromised account can’t directly execute code. The wp-config hardening generator produces both at the press of a button.

What Really Counts – in Order

1. 2FA for all admins.
2. Login limit against brute force.
3. Strong passwords, no “admin” user.
4. Block xmlrpc.php if not needed.
5. New keys and file editor off.
6. Move the login URL (optional extra).

You don’t need more than one security plugin for this – in fact, several at once often interfere with each other. And the best login protection doesn’t replace ongoing upkeep: updates, backups and monitoring belong to it, as described in the security overview.

---

Want to secure the login cleanly without stacking five plugins? Drop us a line – we’ll harden login and backend in a targeted way.