Protect WordPress administration in layers rather than relying on a hidden login URL. Require HTTPS, secure every administrator account with a unique password and two-factor authentication, rate-limit both /wp-login.php and /xmlrpc.php, keep WordPress and extensions updated, and use a web application firewall (WAF) when attacks are large or persistent. Add Basic Authentication or an IP allowlist only after testing compatibility with your site.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
The goal is to block credential guessing before it reaches PHP, make stolen passwords less useful, preserve integrations that genuinely need XML-RPC, and maintain a recovery path for legitimate administrators.
As an Amazon Associate I earn from qualifying purchases.
What you are protecting
/wp-login.php is WordPress’s login script in the site root. When a visitor who is not logged in requests /wp-admin/, WordPress normally redirects that visitor to the login page. Protecting only the visible dashboard directory therefore leaves the login script exposed.
Attackers generally use three routes:
- Credential guessing: automated requests try passwords against
/wp-login.phpor submit many authentication methods through/xmlrpc.php. - Credential reuse: a password stolen from another service is tested against an administrator account.
- Exploit traffic: vulnerable plugins, themes, or outdated core files are targeted independently of the login page.
A complete design addresses all three. Login controls reduce authentication abuse; updates and a WAF reduce unrelated exploit traffic.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Choose controls by where they run
Controls have different visibility and failure modes. An edge service can reject traffic before it consumes server resources, while a WordPress plugin runs only after a request has reached PHP.
| Control | Runs at | Primary protection | Compatibility and operating considerations |
|---|---|---|---|
HTTPS and FORCE_SSL_ADMIN |
Web server and WordPress configuration | Credentials, cookies, and authentication headers in transit | Requires a valid certificate and correct HTTP-to-HTTPS redirects. |
| Unique passwords and a password manager | Administrator account | Password guessing and reused credentials | Does not stop an attacker who already has the password; every administrator must follow the policy. |
| 2FA or a passkey | WordPress account or identity provider | Stolen-password logins | WordPress core does not provide 2FA, so use a maintained plugin or identity provider. Keep a recovery method. |
| Rate limiting | Edge/WAF, web server, or PHP plugin | Automated login and XML-RPC attempts | Edge limits preserve origin capacity. Plugin limits still consume PHP and database resources. |
| XML-RPC restriction | Web server, WAF, or WordPress | Abuse of /xmlrpc.php |
Blocking it can break Jetpack, the WordPress mobile app, or another integration. |
| WAF challenge and blocking | Edge/WAF | Bot traffic, abusive IPs, and some exploit requests | Needs accurate DNS/proxy configuration and a process for false positives. |
| Basic Authentication or IP allowlist | Web server or hosting layer | An additional gate before WordPress login | Can lock out legitimate users and can break wp-admin/admin-ajax.php if applied broadly. |
1. Enforce HTTPS for the entire site
HTTPS is the foundation because it encrypts passwords, session cookies, and authentication headers while they travel between the browser and server. Do not limit HTTPS to the dashboard: mixed HTTP and HTTPS paths can still expose cookies or redirect users through an insecure connection.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchUse WordPress’s administration setting
Set the FORCE_SSL_ADMIN constant to true in wp-config.php, then verify that the site has a valid certificate and that the web server correctly recognizes HTTPS when a reverse proxy or CDN is in front of it.
define( 'FORCE_SSL_ADMIN', true );WordPress documents FORCE_SSL_LOGIN as deprecated in WordPress 4.0; use FORCE_SSL_ADMIN instead. Test logging in, opening the dashboard, uploading media, and saving settings after enabling it. A proxy that fails to pass the HTTPS status to WordPress can create redirect loops, so correct the proxy configuration rather than disabling the setting.
2. Harden every administrator identity
Use unique passwords
Each administrator should have a long, randomly generated password that is not used anywhere else. A password manager makes unique credentials practical and lets you revoke one person’s access without changing a shared password. Remove unused administrator accounts and give editors or authors the lowest role they need.
Require two-factor authentication
Enable 2FA for every administrator, not only the site owner. WordPress core does not include 2FA, so install a maintained security plugin or connect an identity provider that supports it. Prefer a method that resists phishing when your chosen system supports one.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Consider WebAuthn or passkeys
WebAuthn security keys and passkeys use public-key cryptography and can provide phishing-resistant sign-in. Availability depends on the WordPress plugin or identity provider, browser, and device. Register at least two authenticators where possible: one for daily use and one stored securely as a recovery device. Confirm the recovery process before enforcing the requirement, or a lost key can lock out every administrator.
3. Rate-limit the actual login endpoints
Apply limits to both /wp-login.php and /xmlrpc.php. Limiting only the dashboard path misses the script that receives normal browser logins, while ignoring XML-RPC leaves another authentication interface available to automated tools.
Prefer an edge or web-server limit
An edge WAF or web-server rule can count requests and reject, delay, or challenge abusive clients before the request reaches WordPress. This matters during a distributed attack: a PHP plugin may identify the abuse but still spend CPU, memory, and database connections processing every attempt.
Use a combination of signals rather than a single permanent IP ban. Attackers rotate addresses, and a shared corporate network or mobile carrier can put many legitimate users behind one address. Useful signals include request rate, repeated failures, suspicious user agents, geographic policy where appropriate, and whether a session has already passed a challenge.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Set limits conservatively and test them
Start with a threshold that allows a normal administrator to mistype a password occasionally without triggering a lockout. Challenge or temporarily delay suspicious traffic before applying a longer ban. Test from a permitted administrator network and from a separate test address, then inspect server and WAF logs to confirm that rejected requests never reach PHP.
4. Decide what to do with XML-RPC
Disable /xmlrpc.php when no integration needs it. Removing an unused authentication surface is simpler than maintaining an exception list.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Do not block it blindly when the site relies on Jetpack, the WordPress mobile app, or another XML-RPC integration. In that case:
- List every service that calls
/xmlrpc.phpand document its source addresses or authentication method. - Allow only the required traffic where your WAF or web server supports narrowly scoped rules.
- Rate-limit the endpoint separately from browser logins.
- Monitor failed and successful XML-RPC requests after the change.
- Re-test publishing, mobile access, backups, or other integrations that depend on it.
Removing XML-RPC without checking dependencies can appear to fix login abuse while silently breaking publishing or mobile administration.
Recommended Free Tools
5. Add a managed WAF when the threat requires it
A managed WAF or CDN can challenge bots, apply CAPTCHA- or Turnstile-style checks, block abusive addresses, and absorb high-volume traffic before it reaches the origin server. WordPress’s brute-force guidance names Cloudflare, Sucuri, and host-provided WAFs as examples of this type of protection.
Use the WAF for controls that benefit from edge visibility:
- Rate limits for
/wp-login.phpand/xmlrpc.php. - Bot challenges when repeated failures or automation indicators appear.
- Temporary blocks for confirmed abusive sources.
- Rules for obvious exploit patterns against plugins and themes.
Keep an origin-side control as well. If an attacker can discover the server’s direct address and bypass the WAF, edge rules alone do not protect the origin. Restrict direct origin access where your host supports it, and verify that logs preserve the real client address so bans do not target the proxy.
6. Keep WordPress, themes, and plugins current
Outdated plugins and other software are a major attack category. Enable a maintenance process that inventories every extension, removes software that is no longer needed, and applies security updates promptly. Test updates on a staging copy when the site is complex, but do not leave a known vulnerable component exposed indefinitely because testing is inconvenient.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Use least privilege for update access and retain recent backups. A backup is useful only if you have verified that it can be restored and that restored administrator credentials are known.
7. Treat a changed login URL as noise reduction, not security
A plugin that changes the login URL can reduce automated requests that target the default path. It does not protect an account whose password has been stolen, replace 2FA, stop XML-RPC authentication, or patch a vulnerable plugin. Document the new address and maintain an administrator recovery route before enabling it. If the plugin fails or is removed, the normal login path may return or become unavailable depending on its implementation.
8. Scope Basic Authentication and IP restrictions carefully
An additional Basic Authentication prompt or IP allowlist can create a useful second gate for a private administration team. It is strongest when administrators work from stable office or VPN addresses and when the rule is maintained as staff and networks change.
Do not automatically protect every request under /wp-admin/. WordPress explicitly warns that securing the directory broadly can break functionality such as the AJAX handler at wp-admin/admin-ajax.php. Themes and plugins may call that handler for front-end features while the visitor is not logged in.
Free tools Windows power users keep installed
One-click scans. No signup required.
A safer deployment sequence
- Map which URLs your public site, theme, plugins, editors, and integrations call under
/wp-admin/. - Apply the restriction in staging or during a maintenance window.
- Exclude only the endpoints that genuinely need public access, such as the required AJAX handler, rather than opening the whole directory.
- Test the front end while logged out, the dashboard while logged in, media uploads, scheduled tasks, REST or XML-RPC integrations, and plugin settings.
- Keep an emergency administrator path from an allowed network and record how to remove the rule at the host level.
Basic Authentication credentials must also travel over HTTPS. Otherwise the extra prompt can expose another set of credentials in transit.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.9. Build a practical rollout plan
Implement the controls in an order that preserves access while reducing risk quickly:
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
- Inventory access: list administrators, editors, integrations, hosting accounts, proxy addresses, and existing recovery contacts.
- Enable HTTPS: install and test the certificate, redirect HTTP, set
FORCE_SSL_ADMIN, and verify proxy handling. - Secure identities: replace reused passwords, remove dormant administrators, enforce 2FA, and register recovery authenticators.
- Protect endpoints: add edge or web-server rate limits for
/wp-login.phpand/xmlrpc.php. - Choose an XML-RPC policy: disable it when unused; otherwise allow only required integrations and apply a separate limit.
- Add WAF rules: challenge automation, block confirmed abuse, and ensure the origin cannot be reached around the edge.
- Update software: patch core, themes, and plugins; remove abandoned components; verify backups.
- Consider a second gate: add a narrowly scoped IP rule or Basic Authentication only after compatibility testing.
- Document recovery: record the host-level method for removing a lockout, the WAF administrator, emergency contacts, and the location of recovery codes.
10. Monitor and respond to attacks
Review failed logins, successful administrator sign-ins, XML-RPC activity, WAF challenges, and changes to administrator accounts. Alerts should identify the account, time, source address as recorded by the proxy or server, and action taken. A sudden rise in failures from many addresses suggests distributed automation; repeated failures followed by a successful login require an immediate account review.
When an account may be compromised, preserve logs, disable or reset the account, revoke active sessions and application passwords, rotate related secrets, inspect recently changed plugins and administrator accounts, and restore from a known-clean backup if necessary. Do not respond by permanently blocking an entire country or shared network unless the business case and false-positive impact have been assessed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Common failures and fixes
Administrators see a redirect loop after HTTPS is enabled
Check the certificate, HTTP-to-HTTPS redirect, and the reverse proxy’s forwarded-protocol setting. WordPress must be told that the original request was HTTPS; disabling FORCE_SSL_ADMIN merely removes the protection.
Legitimate users are locked out by the rate limit
Shorten the penalty window, use a challenge instead of a permanent block, key rules to a combination of signals, and provide a documented break-glass path. Avoid trusting a spoofable client-IP header.
Mobile publishing stops after XML-RPC is blocked
Identify the integration that needs /xmlrpc.php, restore only its required access, and apply a dedicated rate limit. If no integration is actually needed, leave the endpoint disabled.
Front-end features fail after Basic Authentication is added
Inspect browser network requests for wp-admin/admin-ajax.php and other required endpoints. Narrow the rule rather than exposing all of /wp-admin/, then test while logged out and logged in.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →A WAF blocks administrators or does not see the real IP
Review proxy trust and origin logging, create a narrowly defined administrator exception, and test from more than one network. Never allow an exception broader than the traffic it is meant to protect.
What a strong configuration looks like
For most sites, the defensible baseline is HTTPS with FORCE_SSL_ADMIN, unique administrator passwords, mandatory 2FA with a documented recovery method, edge or server rate limits on both authentication endpoints, current core/themes/plugins, and monitoring for authentication anomalies. Disable XML-RPC if unused; otherwise restrict and rate-limit it. Add a WAF for high-volume or distributed abuse, and use Basic Authentication or an IP allowlist only when you can scope and test the exceptions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
