Login security and two-factor authentication for WordPress

Every WordPress login page on the internet is being tested by bots right now. They try common passwords, and passwords leaked from other websites, thousands of times a day. Most of the time they fail. The login page only has to let one of them through.

Two kinds of attack

• Brute force: guessing passwords over and over, often with lists of the most common ones.
• Credential stuffing: trying email and password combinations leaked from other websites. If you've reused a password anywhere, this is how it comes back to bite you.

Both are automated and cheap to run, which is why they target every site, not just big ones.

1. Use unique, long passwords

A password manager makes this painless. Every account, including hosting, SFTP and the database, should have its own long, randomly generated password. If one leaks, nothing else is affected.

2. Turn on two-factor authentication

Two-factor authentication (2FA) means a password alone isn't enough to log in. After the password, you also need a code from your phone or a physical security key.

The common options are:

• Authenticator app codes: a six-digit code that changes every 30 seconds, from an app like Google Authenticator, Microsoft Authenticator or your password manager. This is the best balance of security and convenience for most people.
• Hardware security keys: a small USB or NFC key. Very secure, ideal for administrators.
• Email codes: better than nothing, but weaker, because anyone who gets into your email gets into your site.

Plugins like Two Factor (maintained by WordPress contributors) or the login security features of the major security plugins add this in minutes. Make it required for every administrator, and save the backup codes somewhere safe.

3. Limit login attempts

Out of the box, WordPress lets anyone try passwords forever. Limiting failed attempts and temporarily blocking repeat offenders stops brute-force attacks cold. Most security plugins and many hosts include this.

4. Mind XML-RPC

xmlrpc.php is an older way for apps to talk to WordPress. It can be used to try many passwords in a single request. If nothing on your site uses it, disable it. Some mobile apps and Jetpack features do rely on it, so check before you switch it off.

5. Give people the role they need

WordPress has roles for a reason:

• Administrator: full control, including installing plugins. Keep this to one or two people.
• Editor: manages all content, but can't change plugins or settings.
• Author and Contributor: write their own posts.

An editor's stolen password does far less damage than an administrator's.

6. Clean up old accounts

Agencies, freelancers and former staff often keep administrator accounts long after the work ends. Review your users every few months and remove anyone who no longer needs access. If someone needs temporary access, create an account for them and delete it afterwards.

7. Is changing the login URL worth it?

Moving the login page from /wp-login.php to a custom address cuts down bot traffic and clutter in your logs. It doesn't replace strong passwords or 2FA, but it's a reasonable extra layer.

The 10-minute version

If you only do three things today: install a password manager, turn on 2FA for every admin, and delete accounts that shouldn't be there.

These steps are part of my security hardening checklist. If you'd like it set up for you, get in touch.