7 Ways to Secure Your WordPress Login Page

WordPress is the most popular CMS in the world because it is easy to set up and simple to customise. That is why we build most of our client sites on it.

That popularity comes with a trade-off. Every WordPress site uses the same login structure by default: /wp-admin or /wp-login.php. Bots that scan the internet for WordPress sites already know this, so they go straight for your login page and start guessing passwords.

A strong password and an SSL certificate are good starting points, but they will not stop a bot from finding your login page in the first place. Back up your site before you make any of the changes below, then work through these seven steps.

1. Create a custom login URL

Changing your login URL is the simplest way to stop bots from finding your login page. It does not affect your site's content or design; it only changes the web address you use to log in.

Plugin: WPS Hide Login

It is free, lightweight and does not touch your WordPress core files, so deactivating it at any point returns your site to normal.

How to set it up

1. Install and activate WPS Hide Login from your Plugins screen.
2. Go to Settings, then WPS Hide Login.
3. Enter your new login URL and save.
4. Log in using the new URL to confirm it works, then update your bookmarks.

If your site runs a caching plugin other than WP Rocket, add your new login URL to that plugin's list of excluded pages. Caching the login page can serve a broken page to real users or reveal that the custom URL exists.

Share the new URL only with people who need it. If someone leaves your team, change the URL again.

Suggested reading: Top SEO Plugins To Boost Your Rankings

2. Hide usernames

A custom login URL stops bots from finding your login page. Hiding usernames stops them from having anything to guess once they do find it.

The first step happens during setup. If your admin account still uses the username "admin," change it. That is the first username every automated attack tries. Create a new administrator account with a different username, move your content across, then delete the old "admin" account.

The second step is ongoing. WordPress often displays usernames publicly, in author archive pages and in blog post bylines. That small detail gives an attacker half of what they need for a brute force attempt.

Plugin: Yoast SEO 

Yoast is a great option if you already use it for your site's SEO. Any SEO plugin with author archive controls will do the same job.

How to set it up:

1. In Yoast, go to Search Appearance and turn off author archives.
2. Go to Users, open a user's profile, and set a nickname under Name.
3. Set the "Display name publicly as" field to the nickname instead of the username.

Nicknames are safe to show publicly. Only hide the actual username, since hiding nicknames removes the byline your readers rely on, especially on posts built around user-generated content.

3. Limit login attempts

WordPress allows unlimited login attempts by default. A bot that has your username can sit on your login page and work through thousands of password combinations until one lands.

Plugin: Limit Login Attempts Security

It blocks an IP address after a set number of failed attempts and is one of the more actively maintained options in this category.

How to set it up:

1. Install and activate the plugin.
2. Open its settings and set a maximum number of login attempts; three is a sensible limit.
3. Set a lockout period for IP addresses that hit that limit.

This alone turns a brute-force attack from thousands of guesses into three. Some WordPress hosting providers block repeated failed logins at server level as well, so it's worth checking what your host already covers before you rely on the plugin alone.

4. Disable XML-RPC if you don't need it

Limiting login attempts closes the front door. XML-RPC is a side door that some attackers use to get around it. XML-RPC is an older WordPress feature that allows remote apps to publish posts and manage comments. It also lets an attacker test hundreds of password combinations in a single request, which bypasses login-attempt limits entirely.

Most sites do not use XML-RPC. You need it only if you publish through a remote app such as the WordPress mobile app, or if a service like Jetpack relies on it.

How to check and disable it:

1. Check whether you use a mobile publishing app or a plugin like Jetpack that needs XML-RPC. If you do, leave it on.
2. If you do not, install a security plugin such as Wordfence Security, which includes an XML-RPC protection option.
3. In Wordfence, go to All Options, then Brute Force Protection, and enable the option to disable XML-RPC authentication. 

If a firewall rule change like this ever throws a 502 gateway error, that's a server-side response, not something broken in your login setup.

5. Add CAPTCHA to your login form

CAPTCHA adds a step that bots cannot complete but humans can, such as ticking a box or solving a simple challenge. It stops automated login attempts before they reach WordPress at all, which takes pressure off the login-attempt and brute force protections above.

Plugin: Google reCAPTCHA v3 

Google reCAPTCHA v3  runs invisibly in the background and only interrupts a login if it detects bot-like behaviour, so real users are not slowed down. Wordfence Security also includes a login-page CAPTCHA option, so if you already installed it for XML-RPC protection above, you can turn on CAPTCHA in the same plugin.

How to set it up:

1. Create a free reCAPTCHA v3 key pair at Google's reCAPTCHA admin console, or use the CAPTCHA option built into Wordfence.
2. Install a CAPTCHA plugin, or enable Wordfence's built-in login CAPTCHA under Login Security settings.
3. Add your site key and secret key if using reCAPTCHA directly.
4. Test the login form to confirm the CAPTCHA loads correctly before you log out.

6. Add two-factor authentication

If a bot or attacker does guess a working username and password, two-factor authentication is what stops them from getting in. It asks for a one-time code from your phone in addition to your password, so a stolen password alone is not enough.

Plugin: Two Factor

Two Factor is maintained by the WordPress core contributor team. It is lightweight and covers most sites well. If you need SMS, WhatsApp or Telegram codes, or you are managing 2FA across a larger team, miniOrange 2FA is the more feature-rich option.

How to set it up:

1. Install and activate the plugin.
2. Go to your user profile and find the Two-Factor Authentication section.
3. Choose the authenticator app option and scan the QR code shown with an authenticator app on your phone, such as Google Authenticator.
4. Enter the six-digit code the app generates to confirm the setup.

From this point, logging in needs your password and a code from your phone.

7. Set an automatic logout

The last gap is an open session. If you leave your WordPress dashboard logged in on a shared or public computer, anyone who sits down after you has full access. WordPress logs users out automatically, but not for two days, or two weeks if "Remember Me" was ticked. That is a long window to leave open.

Plugin: Inactive Logout. 

Keep it updated to the current version, since older releases have had security patches.

How to set it up:

1. Install and activate the plugin.
2. Go to its settings and open Basic Management.
3. Set an idle timeout, for example 15 or 30 minutes.
4. Save your settings.

Any session left idle past that timeout logs out automatically.

The next step for your login security

WordPress is great for your business, but it only stays that way with the right security in place.

If you would like a professional hand with this, we at Digital Treasury can help. We bring everything your WordPress site needs, from building it to maintaining and hosting it. Let's connect.

‍