Prevent WordPress brute-force attacks with layers that stop automated guesses before they consume PHP resources: remove unnecessary administrator accounts, require strong unique passwords and phishing-resistant two-factor authentication, rate-limit /wp-login.php and /xmlrpc.php at the CDN, WAF or web-server level, challenge suspicious traffic, disable XML-RPC when it is not needed, and keep tested backups. A login-security plugin can fill gaps, but edge or server controls are the better first line against high-volume attacks.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What a WordPress brute-force attack is
A brute-force attack repeatedly submits guessed username-and-password combinations to a login surface until one succeeds. WordPress’s Advanced Administration Handbook describes it as the simplest way to break in: the attacker keeps trying combinations rather than exploiting a complicated software flaw. Automated tools can target the normal login form, XML-RPC, or another exposed authentication endpoint.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
The danger is not limited to a successful password guess. Each request can consume web-server workers, PHP processes, database connections and bandwidth. A compromised administrator account can then change content, install malicious code, create new users, steal customer data or use a gaming site to distribute scams. Your goal is therefore twofold: make an account takeover difficult and keep the login traffic from exhausting the site.
The protection order that works best
Apply controls in this order so that inexpensive, high-impact safeguards come before optional hardening:
- Inventory privileged accounts. Remove abandoned administrators, replace legacy usernames such as
admin, and use lower-privilege roles for routine editing. - Harden every credential. Give each user a long, unique password generated and stored by a password manager.
- Require a second factor. Enforce two-factor authentication (2FA) for administrators and other privileged users; use passkeys or WebAuthn where practical.
- Throttle requests before PHP. Rate-limit
/wp-login.phpand/xmlrpc.phpat a CDN, WAF or web server, then add a CAPTCHA or Turnstile challenge for suspicious traffic. - Make an XML-RPC decision. Disable
xmlrpc.phpwhen nothing on the site needs it; otherwise restrict and aggressively rate-limit it. - Reduce follow-on damage. Update WordPress core, themes and plugins, monitor authentication anomalies, use HTTPS, temporarily ban clear abusers and maintain tested backups.
Changing or hiding the login URL can reduce background noise, but it does not replace authentication, rate limiting or a WAF. Treat it as an optional nuisance-reduction measure, never as the main defense.
1. Audit administrators and privileged access
Remove accounts that no longer have a job
Open the WordPress dashboard’s user list and review every account with an Administrator role. Delete abandoned accounts rather than leaving dormant credentials available for guessing. Before deleting a user who owns posts, reassign those posts to an active account so content history is preserved.
Replace predictable usernames
Do not use a public or legacy username such as admin. An attacker who can identify the username has already removed half of the login problem. Create a new administrator with a non-obvious username, transfer content and settings, test the new account, and then remove the predictable one. Do not rely on merely hiding the author name shown on posts; audit the actual login username.
Use least privilege
Give writers, moderators and contractors the lowest role that lets them do their work. Reserve Administrator for people who genuinely need plugin, theme, user and site-setting access. A guessed Editor account is still serious, but it has a smaller blast radius than a guessed Administrator account.
2. Use passwords that automated guessing cannot cheaply predict
Every account needs a password that is long, random and unique to this site. A password manager should generate and store it; do not recycle a password used for email, hosting, a game platform or another WordPress installation. Avoid names, site names, dictionary words, dates, keyboard patterns and short passwords. Passwords built from only one character class are easier to search than long, varied passphrases.
- Generate the password rather than modifying an old one with a final number or symbol.
- Store the password in a reputable manager and protect that manager with its own strong authentication.
- Reset credentials immediately when a staff member leaves, an account is exposed, or the same password was used elsewhere.
- Never send an administrator password through a public chat, an issue tracker or an email thread.
A strong password does not stop an attacker from sending requests, so pair it with 2FA and rate limiting. Password quality is one layer, not a reason to omit the others.
Recommended Free Tools
3. Require 2FA, with passkeys for the strongest login
WordPress core does not ship with built-in 2FA. Use a maintained login-security plugin or an identity provider that supports the accounts and workflows your site needs. Enforce enrollment for administrators first, then extend the policy to any role that can edit code, manage users or access sensitive data.
Choose the authenticator
- Passkeys/WebAuthn: Phishing-resistant, passwordless authentication using a platform authenticator such as Face ID, Touch ID or Windows Hello, or a hardware security key. The private credential stays with the authenticator, so a fake login page cannot simply collect a reusable code.
- FIDO2 security key: A physical passkey authenticator that can be kept on a keyring or in a secure location. It is useful for administrators who need a separate, durable device.
- Time-based one-time passwords (TOTP): A stronger layer than password-only login, but codes can still be phished if entered into a fraudulent page. Protect the authenticator app and its backup process.
Plan recovery before enforcing the policy
Enroll a backup authenticator for each administrator before making 2FA mandatory. Store recovery codes offline and document who can approve an emergency reset. Test the recovery path with a non-production account; an untested policy can lock out the legitimate team during a phone loss or device replacement.
4. Rate-limit the login endpoint before PHP runs
The most effective place to absorb a high-volume attack is the CDN, WAF or web server, in front of WordPress. A PHP plugin must start WordPress for each request it evaluates, which means abusive traffic can still consume CPU, memory and database resources even when every login is eventually rejected.
Protect /wp-login.php
Create a rule for requests to /wp-login.php. Start with a per-IP request threshold appropriate for your legitimate staff and integrations, then return a temporary denial or challenge when the threshold is exceeded. Apply the rule narrowly to this path so ordinary pages and game downloads are not throttled accidentally. If your edge service supports separate rules for successful and failed logins, make repeated failures progressively slower or block them for a short period.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Use a web-server rule when no edge service is available
Nginx, Apache and many managed hosts can enforce connection or request limits before PHP. Test changes in staging first. A badly scoped directory rule can break admin-ajax.php, REST requests or other WordPress functionality. Roll out one rule at a time, verify administrator login, publishing, media uploads and scheduled tasks, and keep a documented rollback.
Add a challenge for suspicious traffic
CAPTCHA or Turnstile challenges are useful when traffic looks automated but should not be blocked permanently. Place the challenge on the login flow or trigger it only after suspicious behavior, rather than adding friction to every visit. Ensure the challenge works for your accessibility needs and does not block trusted editors using mobile networks or a corporate gateway.
5. Decide whether XML-RPC should remain enabled
The xmlrpc.php endpoint can accept remote WordPress requests and has historically been a frequent target for password guessing, including batched system.multicall requests. Do not leave it open by default without knowing why it is needed.
Disable it when no integration depends on it
If your site does not use a mobile publishing app, Jetpack connection or another XML-RPC integration, disable xmlrpc.php at the edge, web server or WordPress configuration layer. Verify that publishing, comments, scheduled jobs and any external workflow still operate after the change.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Restrict it when it is required
When an integration needs XML-RPC, allow only the required traffic and apply a stricter rate limit than the normal login page. Restrict by trusted network or application capability where your setup permits it, and monitor for repeated failures. Make sure the rule covers system.multicall; blocking only single requests can leave the batched attack path available.
Do not disable XML-RPC blindly on a site whose editors depend on a mobile app. Document the dependency, test the replacement workflow and schedule a controlled change instead.
6. Keep the software that handles authentication current
Update WordPress core, themes and plugins promptly through a maintained process. Security updates can close vulnerabilities that attackers exploit after a login, while abandoned plugins can create an additional route around otherwise strong authentication.
- Remove plugins and themes that are inactive, abandoned or no longer required instead of merely deactivating them.
- Use a staging copy to test updates that affect login, memberships, commerce or game-community features.
- Confirm that updates did not disable your 2FA provider, CAPTCHA, XML-RPC restriction or rate-limit rule.
- Keep HTTPS enabled for the entire site, including the login page and administrative screens.
7. Monitor failed logins and respond to an active attack
Collect authentication events from the edge service, web server and WordPress security layer where possible. Look for bursts of failures against one username, attempts spread across many usernames, repeated requests to xmlrpc.php, sudden geographic changes and successful logins at unusual times.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →When requests are merely noisy
Let the edge rate limit and challenge absorb the traffic. Review whether legitimate editors are being challenged and adjust the rule narrowly rather than opening the endpoint for everyone.
When one source is clearly abusive
Apply a temporary IP or network ban at the edge and record the reason, start time and expiry. Avoid broad country blocks unless there is a documented business need; they can lock out legitimate players, staff and accessibility services. Keep exceptions narrow and review them regularly.
When an account may be compromised
Disable the account, reset its password from a clean device, revoke active sessions and rotate any credentials it could access. Review newly created users, changed administrator roles, modified plugins and unexpected scheduled tasks. Restore from a known-good backup only after identifying and closing the entry path.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How the main controls compare
| Control | Where it runs | Attack-time resource cost | Authentication strength | XML-RPC and mobile compatibility | Operational considerations |
|---|---|---|---|---|---|
| CDN or WAF rate limit | Edge, before the origin | Lowest origin cost; absorbs high-volume traffic upstream | Protects the endpoint; does not replace a second factor | Can cover both login paths; rules must allow required integrations | Usually configured by the host or edge provider; test thresholds and trusted exceptions |
| Web-server rate limit | Origin server, before PHP | Lower PHP cost than a plugin; still uses server connections | Protects the endpoint; does not authenticate the user | Can target /wp-login.php and /xmlrpc.php separately |
Requires server access; incorrect directory rules can break admin-ajax.php |
| Login-security plugin | Inside WordPress/PHP | Consumes PHP resources for each request during an attack | Can add 2FA, TOTP, CAPTCHA and lockouts | Compatibility depends on the plugin and integration settings | Useful when edge controls are unavailable; choose a maintained plugin and test updates |
| Passkey/WebAuthn | Authenticator plus WordPress login layer | Little server overhead beyond normal authentication | Phishing-resistant and passwordless | Works independently of XML-RPC; enrollment and recovery must be planned | Requires supported devices or a FIDO2 key and a backup authenticator |
| TOTP 2FA | Authenticator app plus WordPress login layer | Little additional server overhead | Stronger than password-only; codes can still be phished | Does not depend on XML-RPC | Requires secure backup and recovery-code handling |
| CAPTCHA or Turnstile | Login request, commonly enforced at the edge | Reduces automated submissions before or during login | Bot challenge, not a replacement for 2FA | Can be applied to login while leaving required XML-RPC integrations alone | Use adaptively for suspicious traffic and check accessibility |
A practical implementation checklist
- Record dependencies. List every administrator, publishing workflow, mobile app, remote integration and monitoring system that touches WordPress.
- Clean the user list. Delete abandoned administrators, replace predictable usernames and downgrade routine accounts.
- Reset credentials. Generate a unique password for each privileged account with a password manager; revoke shared credentials.
- Enroll 2FA. Require a passkey, FIDO2 security key or TOTP method, and register a backup authenticator plus offline recovery codes.
- Configure edge throttling. Add separate rules for
/wp-login.phpand/xmlrpc.php; begin with conservative thresholds and observe legitimate use. - Add adaptive challenges. Challenge suspicious login traffic with CAPTCHA or Turnstile instead of forcing every visitor through a challenge.
- Choose an XML-RPC state. Disable it if unused; otherwise restrict access, rate-limit it aggressively and cover
system.multicall. - Test server changes. In staging, verify login, logout, publishing, media uploads,
admin-ajax.php, REST features, scheduled tasks and mobile workflows. - Update and remove software. Patch core, themes and plugins; uninstall components that are no longer maintained or needed.
- Exercise recovery. Restore a backup to a test location, confirm that it contains the database and uploads, and document who can recover the site if administrators are locked out.
Troubleshooting common failures
Legitimate editors are blocked
Check whether several editors share one office, VPN or mobile carrier address. A per-IP rule can treat them as one attacker. Raise the threshold carefully, use authenticated exceptions where supported, or apply a challenge rather than a permanent block. Do not remove rate limiting from the entire endpoint.
The mobile app stopped publishing
The app may depend on XML-RPC. Confirm the dependency in staging, then either re-enable narrowly with strict rate limiting or move the workflow to a supported alternative. Never open the endpoint broadly just to make one integration work.
WordPress functions fail after a server rule change
Rollback the most recent rule and test admin-ajax.php, REST requests, media uploads and scheduled tasks. Directory protection applied too broadly is a common cause. Reapply the control to the exact login paths rather than the whole administrative directory.
An administrator lost the second-factor device
Use the preplanned backup authenticator or offline recovery code. If neither is available, follow a documented identity-verification and emergency-reset process from a clean device, then enroll a new primary and backup authenticator and review recent login events.
Attack traffic continues after changing the login URL
Changing the URL does not remove xmlrpc.php or other authentication paths, and scanners may discover the new location. Keep the URL change only if it helps reduce noise; rely on edge throttling, 2FA, XML-RPC controls and monitoring for protection.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat to avoid
- Do not depend on a hidden login URL as your only defense.
- Do not install several overlapping lockout plugins without testing their interaction; conflicting rules can lock out staff or fail open.
- Do not use permanent, broad country or IP blocks without documenting exceptions and an expiry review.
- Do not disable XML-RPC before checking mobile, remote publishing and other integrations.
- Do not test new server rules directly on a live gaming community site without a rollback and a staging check.
- Do not assume a successful backup exists until you have restored it and verified the result.
Final decision
For most WordPress sites, the strongest practical baseline is unique password-manager credentials, mandatory administrator 2FA with a passkey or security key where available, edge or web-server rate limits on both login endpoints, adaptive CAPTCHA or Turnstile challenges, and a deliberate XML-RPC policy. Add software updates, least-privilege access, anomaly monitoring, HTTPS and tested backups to limit the damage if an attacker gets through. This layered approach protects both the account and the resources that keep your site online.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
