On a WordPress site left in its default configuration, the login page is probably the most requested resource on the server, not by real visitors, but by bots continuously testing credential combinations. This activity, known as a brute force attack, exploits the fact that the login URL is identical across millions of WordPress installations worldwide. The good news is that a handful of simple measures is enough to turn away the vast majority of these attempts, without requiring advanced skills.
Why this threat hits WordPress so hard
WordPress powers a very large share of websites worldwide, which makes it a prime target for automated scripts that do not aim at one specific site, but sweep the entire internet looking for poorly protected installations. A significant share of these login attempts uses passwords already compromised in data breaches elsewhere on the web, which makes reusing a password across several services particularly risky for an administrator account.
Changing the admin username
If your main administrator account is still named admin, half of an attacker's work is already done: all that remains is guessing the password. WordPress does not allow renaming an existing username, but it is simple to create a new user with a distinct name and administrator rights, transfer existing content to this new account, then delete the old admin account.
Limiting the number of login attempts
Without restriction, a bot can test several thousand combinations per minute. A login attempt limiting plugin, such as Limit Login Attempts Reloaded or equivalent features built into broader security suites, temporarily blocks an IP address after a defined number of failures, typically five attempts followed by a lockout of a few minutes to a few hours. This single measure alone is enough to make an automated attack far too slow to be worthwhile.
Adding two factor authentication
WordPress does not natively offer two factor authentication in its core software, this feature must be added through a dedicated plugin. Once enabled, it requires, in addition to the password, a temporary code generated by a smartphone app, which makes a stolen password useless on its own for an attacker. This protection should be required for every account with administrator or editor rights, not just the main account.
Changing the login URL
Bots systematically target the default addresses, wp-login.php and wp-admin. A plugin such as WPS Hide Login lets you replace this address with a custom URL known only to you. This measure does not replace the previous protections, but considerably reduces the volume of automated attempts that actually reach your server, since most bots never look beyond a missing default address.
Disabling XML-RPC if you don't use it
This file, present by default on WordPress, enables remote connections used by certain mobile apps or external publishing tools. It is also an additional attack vector, notably for grouped login attempts that sometimes bypass standard limiting. If no tool used by your business depends on it, disabling it at the server level or through a plugin closes this door with no functional loss.
Relying on your hosting provider
Many managed hosting providers already offer a web application firewall and filtering of suspicious attempts at the network level, before the request even reaches WordPress. Checking what your current hosting actually offers sometimes reveals that part of the protection is already in place, and that the effort required on the site side is limited to the complementary measures described here.
Points to verify before publishing: confirm that the plugins mentioned (Limit Login Attempts Reloaded, WPS Hide Login) are still maintained and available in the official WordPress directory at the time of publication, and check that the lack of native two factor authentication in WordPress core remains accurate as of that date.