Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Stop WordPress brute-force attacks with layers that work together: remove unnecessary administrator accounts, use long unique passwords, require two-factor authentication or passkeys, rate-limit /wp-login.php and /xmlrpc.php before requests reach PHP, challenge suspicious traffic with CAPTCHA or Turnstile, and keep tested backups. Disable XML-RPC when nothing on your site needs it; otherwise restrict and throttle it. A hidden login URL alone is not a security control.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What a WordPress brute-force attack is
A brute-force attack is repeated submission of guessed usernames and passwords until one succeeds. Automated scripts can target the normal login form at /wp-login.php, the XML-RPC endpoint at /xmlrpc.php, or other login surfaces exposed by plugins and integrations. WordPress.org’s Advanced Administration Handbook describes brute force as the simplest way to break in: an attacker keeps trying username/password combinations until one works.
As an Amazon Associate I earn from qualifying purchases.
Even when every guess fails, high-volume requests consume web-server workers, PHP processes, database connections and bandwidth. That can slow the site for legitimate visitors. A successful administrator login is more serious: the intruder may install a malicious plugin, alter content, create another privileged account or steal data. The objective is therefore twofold: make credentials difficult to guess and stop large numbers of guesses before WordPress has to process them.
Use this implementation order
The sequence below starts with account and authentication decisions, then moves controls outward to the network edge. Work through it on a staging copy when possible, especially before changing server rules or XML-RPC behavior.
1. Inventory and reduce privileged accounts
In the WordPress dashboard, open Users > All Users and review every account with an Administrator role. Remove abandoned accounts, accounts belonging to former contractors and duplicate administrators. Change an account’s role to the least privilege needed for its normal work; editors and authors should not be administrators simply for convenience.
Avoid legacy usernames such as admin. If an old administrator uses a predictable username, create a new administrator with a non-obvious username, transfer the old account’s content, verify the new login, and delete or demote the old account. Do not rely on hiding a username: WordPress author archives, REST responses or old posts can disclose account names, and the password remains the real barrier.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Keep a documented list of people who can administer the site.
- Give each person an individual account; never share one administrator login.
- Remove accounts that cannot enroll in your required second factor.
- Review administrator membership after staff or agency changes.
2. Replace weak and reused passwords
Generate a long, random password for every privileged account and store it in a reputable password manager. Never reuse a WordPress password on email, hosting, domain registration or another site. Avoid names, site names, company words, dictionary terms, dates and short passwords. A password made from only one character class is easier to search than a long, randomly generated value.
Reset passwords from the user’s profile in Users > Profile (or the equivalent profile screen for the account), then sign out existing sessions if your security tooling offers that option. A password manager also makes unique credentials practical for lower-privilege accounts, reducing the chance that a password exposed elsewhere will work on WordPress.
Strong passwords do not stop all attacks: credential stuffing uses passwords stolen from other services, while phishing can trick a user into revealing a new password. Treat password quality as the first layer, not the complete solution.
3. Require a second factor for administrators
WordPress core does not include built-in two-factor authentication. Use a maintained login-security plugin or an identity provider that can enforce a second factor for administrators and other privileged users. Prefer enforcement over an optional prompt: an administrator who has not enrolled should be blocked from privileged access until enrollment is complete.
Recommended Free Tools
Time-based one-time passwords (TOTP) from an authenticator application are substantially stronger than password-only login, but they can still be phished if a user enters the current code into a fraudulent site. Passkeys using WebAuthn provide phishing-resistant, passwordless authentication through a platform authenticator such as Face ID, Touch ID or Windows Hello, or through a physical FIDO2 security key. The authenticator signs the login for the genuine site instead of transmitting a reusable code.
- Choose the authentication method your team can support and document its recovery process.
- Enroll every administrator and test a normal login and a failed second-factor attempt.
- Register a backup authenticator for each person, stored separately from the primary device.
- Store one-time recovery codes offline where the account owner can retrieve them without weakening the site.
- Remove lost or retired authenticators immediately from the user’s security settings.
A FIDO2 security key is useful for administrators who need a dedicated physical authenticator or who cannot rely on a personal phone. Keep at least one backup key or another documented recovery method; otherwise a lost key can lock the entire team out.
4. Rate-limit the login endpoint before PHP
Configure rate limiting at your CDN, WAF or web server for /wp-login.php. This is preferable for high-volume attacks because the request can be delayed or rejected before WordPress loads PHP, plugins and the database. Set a policy that allows normal staff behavior but limits repeated failures from one address or network. Record the rule, its threshold and the exception process so a legitimate office, VPN or support team is not permanently blocked.
If your host provides a security or firewall panel, look for controls named login rate limiting, brute-force protection, bot challenge or WAF rules. If you manage the web server directly, apply the rule to the login path rather than indiscriminately blocking all traffic. Test in staging first: an overly broad directory rule can break admin-ajax.php, the REST API or front-end forms.
When edge or server controls are unavailable, a maintained WordPress login-security plugin can count failures, delay responses and block abusive addresses. That is still useful, but the plugin runs inside PHP, so a sufficiently large attack can consume resources before the plugin rejects the request. Use application-layer protection as a fallback or an additional layer, not as the only defense for a heavily attacked site.
5. Challenge suspicious traffic
Add CAPTCHA or Turnstile challenges to the login flow when traffic appears automated, when a client exceeds a failure threshold, or when your WAF identifies a risky source. A challenge on every login may frustrate users and users with accessibility needs, while a challenge only after suspicious behavior preserves a smoother normal experience.
Make sure the challenge is applied to the actual login form and that it does not prevent password-manager autofill, passkey prompts or the recovery workflow. Test successful login, an incorrect password, a blocked request and a legitimate user behind a shared corporate address.
6. Decide whether XML-RPC is needed
XML-RPC is an alternate WordPress interface. If your site does not use it, disable /xmlrpc.php at the edge or web server and confirm that publishing, monitoring and mobile workflows still operate. Disabling the endpoint removes one login surface and prevents XML-RPC-specific abuse.
Do not disable it blindly. Jetpack, WordPress mobile applications and some external publishing or management integrations may require XML-RPC. If an integration is necessary:
- Allow only the required endpoint and, where practical, known source networks.
- Apply a stricter rate limit than the normal login form.
- Monitor requests to methods that are not needed by your integration.
- Pay particular attention to
system.multicall, which attackers frequently use to bundle many authentication attempts into one request. - Test publishing, media uploads and remote administration after every rule change.
Document which service depends on XML-RPC. Without that record, a future administrator may re-enable the endpoint for compatibility without realizing why it was restricted.
7. Keep every WordPress component current
Update WordPress core, themes and plugins promptly from trusted release channels. Security fixes in a plugin or theme can matter even when your immediate concern is login guessing: a separate vulnerability may let an attacker bypass authentication or create a privileged account. Remove inactive plugins and themes instead of leaving them installed, and use only extensions that are maintained and compatible with your WordPress version.
Schedule updates during a maintenance window when the site is business-critical. Take a backup first, update one component at a time when troubleshooting is difficult, and verify the login page, administrator dashboard, forms, checkout or publishing workflow after the update.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
8. Enforce HTTPS and protect session recovery
Use HTTPS for the entire site, including the login and administration areas. Confirm that HTTP requests redirect to HTTPS and that no mixed-content warning exposes an insecure login form. HTTPS protects credentials in transit; it does not make a weak password resistant to guessing, so keep the rate limits and second factor in place.
Review password-reset email, administrator email addresses and hosting-panel access. An attacker who controls the mailbox or hosting account can often recover WordPress access despite strong login settings. Restrict hosting-panel accounts, use separate credentials, and enable multi-factor authentication there as well.
9. Monitor authentication anomalies
Collect failed-login and successful-login events from the WAF, web server and WordPress security tooling. Alert on patterns rather than one isolated failure:
- A rapid increase in failures against one username or many usernames.
- Successful administrator logins from a new country, network or device.
- Logins immediately followed by a new administrator account, plugin installation or theme change.
- Repeated requests to
/xmlrpc.phpor use ofsystem.multicallwhen no integration should be using it.
Retain enough context to investigate: timestamp, source address, requested path, username (where legally appropriate), result and the rule that acted on the request. Synchronize server clocks so events can be correlated with hosting, identity-provider and email logs.
10. Maintain and test backups
Keep regular backups of the database, uploads and configuration, with at least one copy unavailable to the WordPress server while it is running. A backup that has never been restored is only an assumption. Periodically restore it to a staging site, verify media and administrator access, and record how long recovery takes.
Backups do not prevent brute force, but they limit the damage if an attacker obtains an administrator account and changes content or installs malware. Protect the backup system with separate credentials and multi-factor authentication so a compromised WordPress account cannot erase every recovery copy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How the main controls differ
| Control | Where it runs | Effect during a high-volume attack | Authentication or compatibility notes |
|---|---|---|---|
| Long unique passwords | WordPress account | Stops guessing only when the password is not predictable or reused; does not reduce request volume | Works with every WordPress integration but remains password-only |
| TOTP two-factor authentication | WordPress login or identity provider | Blocks an attacker who knows only the password; login requests still reach the application unless separately throttled | Requires enrollment, recovery codes and a maintained implementation |
| Passkey or FIDO2 key | Browser and authenticator, with WordPress or identity provider verification | Resists password guessing and phishing; rate limiting is still needed to protect the endpoint | Phishing-resistant and passwordless; requires backup authenticators and compatible devices |
| CDN/WAF or web-server rate limit | Network edge or server | Rejects or delays requests before PHP, conserving application resources | Can cover both /wp-login.php and /xmlrpc.php; requires careful exceptions |
| Login-security plugin | WordPress/PHP | Can delay, count and block attempts but still consumes PHP resources | Useful when edge controls are unavailable; verify maintenance and compatibility |
| CAPTCHA or Turnstile | Login flow, often coordinated with an edge service | Raises the cost of automation; does not replace passwords or second factors | Apply selectively to avoid accessibility and usability problems |
| Disable XML-RPC | Edge, server or WordPress configuration | Removes that endpoint entirely when no integration needs it | Breaks clients that depend on XML-RPC, including some mobile or publishing tools |
| Change the login URL | WordPress routing or plugin | May reduce automated noise but does not stop discovery or attacks on other endpoints | Never use it instead of authentication, throttling or a WAF |
Choose a design for your site
Small brochure or personal site
Start with one administrator account per person, a password manager, passkeys or TOTP, automatic component updates with review, HTTPS, a maintained login-security plugin and tested backups. Disable XML-RPC if no mobile or remote-publishing feature uses it. Ask your host whether a WAF rule can rate-limit the two endpoints; that is more valuable than adding several overlapping plugins.
Membership, ecommerce or publishing site
Use edge rate limiting because many customers or editors may log in while an attack is running. Apply challenges only to suspicious traffic, and set separate policies for customer accounts, editors and administrators. Keep XML-RPC only when a documented integration needs it, then allowlist or tightly throttle that traffic. Monitor successful administrator logins and privilege changes, not just failed guesses.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsAgency, newsroom or multi-administrator site
Centralize identity where practical, require phishing-resistant passkeys or security keys for privileged users, and maintain an emergency account with a documented break-glass procedure. Review administrator membership on every staff change. Give the WAF and hosting teams a written exception process so a shared office address is not accidentally blocked during an incident.
Test the defenses without locking yourself out
- Create a staging copy or schedule a maintenance window.
- Confirm that an administrator can sign in with the correct password and second factor.
- Verify that an incorrect password is delayed, challenged or blocked according to the documented policy.
- Send repeated requests to
/wp-login.phpfrom a controlled test client and confirm that the edge or server rule acts before PHP when that capability is available. - If XML-RPC is disabled, test every documented mobile, publishing and monitoring integration. If it remains enabled, verify its allowlist and rate limit and test the required methods.
- Check that
admin-ajax.php, the REST API, front-end forms and password recovery still work; broad directory protection can break these functions. - Test the backup restoration procedure and confirm that logs and alerts contain enough information to investigate.
- Record the final rules, thresholds, exceptions, owner and rollback steps.
Troubleshoot common failures
Legitimate staff are blocked
Look for a shared office, VPN or mobile carrier address exceeding the threshold. Narrow the rule to the login paths, reduce the block duration, or create a documented exception for a trusted network. Do not permanently allowlist an entire country or broad consumer network merely to solve one false positive.
XML-RPC breaks after hardening
Identify which integration made the request before reopening the endpoint. If the service is required, permit only its traffic where feasible and apply a strict rate limit. If no one can identify a legitimate dependency, leave XML-RPC disabled and remove obsolete client settings.
The site slows down despite a plugin lockout
The plugin is probably rejecting attempts after PHP has started. Move the first rate limit to the CDN, WAF or web server, then retain the plugin for application-level logging and account controls. Ask the host whether upstream filtering is available.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Administrators lose access after enabling 2FA
Use the documented recovery code or backup authenticator, then enroll a replacement device and remove the lost one. If no recovery method exists, follow the host’s verified emergency procedure rather than disabling all protection permanently. Document the incident and add a second recovery path before re-enabling enforcement.
A hidden login URL did not stop attempts
Assume the new URL can be discovered and protect it with the same password, second-factor, CAPTCHA and rate-limit controls. Keep the standard endpoints in your monitoring because attackers may switch to XML-RPC, REST-based workflows or a vulnerable plugin instead.
Quick Recap
What to do when an administrator account may be compromised
- Use a known-clean device to disable or suspend the suspected account and revoke active sessions.
- Preserve WAF, web-server, WordPress, hosting and identity-provider logs before rotating them.
- Reset the account password and the associated email or hosting credentials, then replace or revoke its authenticators if they may be exposed.
- Review all administrators, newly installed plugins, modified themes, scheduled tasks, redirects and content changes.
- Restore from a verified clean backup when integrity is uncertain; do not overwrite evidence before deciding what must be investigated.
- Patch the vulnerable component, tighten edge rules and require a second factor before restoring normal access.
- Notify affected users or authorities when your legal, contractual or regulatory obligations require it.
Practical checklist
- Every administrator has an individual account and the least role needed.
- No privileged account uses
admin, a site name or a reused password. - Administrators use enforced TOTP, passkeys or security keys, with a tested backup authenticator.
/wp-login.phpis rate-limited at the edge or web server, with a documented exception process.- Suspicious login traffic receives a CAPTCHA or Turnstile challenge.
/xmlrpc.phpis disabled when unused, or restricted and aggressively rate-limited when required.- Core, themes and plugins are current, and unused extensions are removed.
- HTTPS covers the entire site and hosting and email accounts have their own strong authentication.
- Failed and successful authentication anomalies generate actionable alerts.
- Backups include database, uploads and configuration, with an offline-capable copy and a tested restore.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
