Protect WordPress administration with layers rather than a hidden login URL alone: enforce HTTPS, give every administrator a unique password and phishing-resistant second factor, rate-limit both /wp-login.php and /xmlrpc.php, keep all software current, and place a managed WAF in front of the site when attack volume or hosting limits justify it. Add BasicAuth or an IP restriction only after checking that legitimate requests such as admin-ajax.php still work.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Know which WordPress endpoints you are defending
WordPress has two paths that are often confused. /wp-login.php is the login script in the site root. A visitor who opens /wp-admin/ while logged out is normally redirected to that script. Protecting only the directory therefore does not protect the actual credential-entry endpoint.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The other commonly abused endpoint is /xmlrpc.php. XML-RPC can accept remote publishing and other API-style requests. It is not the same as the browser login form, but attackers can use it for password guessing when it is enabled. Treat both paths as authentication surfaces in your firewall and monitoring rules.
Build the protection in layers
Each control addresses a different failure mode. HTTPS prevents interception in transit; account controls reduce the chance that a guessed or stolen password works; rate limits and WAF rules absorb automated attempts; updates remove exploitable software defects; and monitoring gives you a way to detect and recover from abuse.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
| Control | Runs at | Main threat addressed | Compatibility or recovery concern |
|---|---|---|---|
HTTPS with FORCE_SSL_ADMIN |
Web server and WordPress configuration | Credential, cookie, and authentication-header interception | A certificate, correct redirects, and a working HTTPS site are required |
| Unique passwords and 2FA | WordPress account or identity provider | Password reuse, phishing, and stolen credentials | Store recovery codes and maintain a second administrator or documented recovery route |
| WebAuthn or passkeys | Maintained WordPress plugin or identity provider | Phishing and replay of passwords or one-time codes | Enrollment and device-loss recovery must be planned |
| Rate limiting | Edge WAF, web server, or PHP plugin | Automated guessing and request floods | Limits must allow legitimate logins and integrations; PHP-level limits still consume origin resources |
| XML-RPC policy | Web server, WAF, or WordPress | Password guessing and unwanted remote calls | Disabling it can break Jetpack, the mobile app, or another integration |
| BasicAuth or IP restriction | Web server or edge | An additional gate before WordPress | A blanket rule can break wp-admin/admin-ajax.php; lockouts require an out-of-band recovery path |
| Updates and monitoring | WordPress maintenance and logging systems | Known plugin, theme, and core vulnerabilities; unnoticed abuse | Test updates and retain access to logs and administrator recovery channels |
1. Require HTTPS for the whole site and administration
Make the entire site use HTTPS, not just the login page. The encrypted connection protects passwords, session cookies, and authentication headers while they travel between a browser and the site. WordPress identifies FORCE_SSL_ADMIN as the setting for forcing HTTPS in the administration area. FORCE_SSL_LOGIN was deprecated in WordPress 4.0, so do not build a new configuration around it.
Set the WordPress administration flag
- Obtain and install a valid certificate for the site hostname, including any administrator-facing hostname you actually use.
- Configure the web server or hosting control panel to redirect HTTP requests to HTTPS and verify that the redirect does not loop.
- In
wp-config.php, before the line that says WordPress has stopped editing, add:
define('FORCE_SSL_ADMIN', true);- Sign out, clear an old browser session if necessary, and test a fresh visit to
https://example.com/wp-login.phpandhttps://example.com/wp-admin/. - Check that cookies are issued on the HTTPS host and that media, AJAX requests, and any reverse-proxy configuration also use the correct scheme.
If a proxy or CDN terminates TLS before the origin, make sure the origin receives the proxy’s HTTPS indication and that WordPress is configured consistently with the hosting provider’s documented reverse-proxy setup. An inconsistent scheme can cause redirect loops or repeatedly log administrators out. Do not treat a browser padlock on one page as proof that every administrative request is encrypted.
2. Harden every administrator identity
Use unique, long passwords
Give each administrator a separate account and a password that has never been used on another service. A password manager makes unique passwords practical and avoids sharing one credential among staff. Remove unused administrator accounts and reduce other users to the lowest role that lets them do their work. A shared administrator login makes it impossible to attribute changes and makes revocation difficult when someone leaves.
Require two-factor authentication
Current WordPress hardening guidance calls for 2FA on every administrator account. WordPress core does not include a built-in 2FA system, so use a maintained security plugin or an identity provider that supports WordPress. Enforce enrollment rather than merely offering it: an administrator who never activates the second factor still has password-only access.
Prefer a phishing-resistant WebAuthn credential or passkey when the selected, maintained plugin or identity provider supports it. Hardware security keys and platform passkeys can bind authentication to the legitimate site and are less susceptible to a fake login page than passwords or codes. Keep at least two enrolled authenticators where policy permits, and store the service’s recovery codes in a protected location. Test the recovery process before an administrator loses a phone or security key.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Plan lockout recovery
Before enforcing 2FA, designate a recovery owner and document how access will be restored using the provider’s approved recovery process. Do not create a permanent password-only back door. If all administrators lose their second factors, use a controlled hosting or database recovery procedure, rotate credentials afterward, and record the incident.
3. Rate-limit the real attack targets
Apply throttling to both /wp-login.php and /xmlrpc.php. A rule aimed only at /wp-admin/ misses the login script that receives the credentials. Rate limits should count failed authentication attempts and, where possible, account or source behavior rather than relying on a single IP address; distributed attacks can use many addresses.
Prefer an edge or web-server control for high-volume attacks
An edge WAF or reverse proxy can reject, challenge, or slow abusive requests before they reach the hosting server. That preserves origin CPU, memory, PHP workers, and database capacity during a distributed attack. WordPress’s brute-force guidance gives managed WAF services such as Cloudflare, Sucuri, and host-provided WAFs as examples of this type of protection.
At the edge, create narrowly scoped rules for the two paths, require a normal browser challenge when behavior looks automated, and set a failure threshold that does not lock out a real administrator who mistypes a password once or twice. Exempt trusted automation only when you can identify it reliably; broad country or user-agent exceptions are easy for attackers to imitate. Confirm that the WAF sees the real client address correctly through the provider’s documented headers, or its limits may group every visitor under the proxy’s address.
Use web-server or application limits as a second line
If an edge service is unavailable, configure the web server to limit request frequency and concurrent requests for the two endpoints. A WordPress security plugin can add login throttling, but it runs after the request has reached PHP and therefore still consumes origin resources. Application throttling is useful defense in depth, not a substitute for an edge control when the server is being saturated.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Measure the effect of a rule with a normal login, a failed login, password reset, the block-editor autosave flow, and any XML-RPC integration. Record the threshold, duration, response code, and the administrator who can change it. A limit that silently returns a generic server error is harder to diagnose than an explicit temporary response and a useful log entry.
4. Decide deliberately what to do with XML-RPC
Disable /xmlrpc.php only when you have confirmed that no required service uses it. Jetpack, the WordPress mobile app, and other integrations may depend on XML-RPC. Blocking it without checking can remove publishing, notification, or remote-management features that a site still needs.
When no integration needs it
Block requests to /xmlrpc.php at the WAF or web server. An edge block is preferable because unwanted requests are discarded before PHP runs. Keep the rule documented so a future administrator knows why the endpoint is unavailable.
When an integration needs it
Leave the endpoint available only to the required service where reliable restriction is possible, and apply the same rate limiting used for login attempts. Monitor method usage and failed authentication, and revisit the exception whenever the integration changes. Do not assume that a known integration makes every XML-RPC request safe; it still deserves a narrow allow rule and abuse detection.
Recommended Free Tools
5. Put a WAF and monitoring around the login surface
A managed WAF can combine IP reputation, bot challenges, CAPTCHA- or Turnstile-style checks, request-rate controls, and temporary blocks. It is especially valuable when the origin host has limited PHP workers or when attacks arrive from many networks. Choose rules that protect the two authentication endpoints without challenging ordinary public pages or legitimate administrator workflows.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Log the signals that help you respond
- Record successful and failed administrator logins, password-reset requests, 2FA failures, and changes to administrator roles.
- Capture timestamp, requested path, source address as seen by the trusted proxy, response status, and the rule that acted.
- Alert on a sudden rise in failures, many usernames from one source, one username tried from many networks, impossible travel, or a successful login immediately after a large guessing burst.
- Retain enough history to distinguish a short-lived scan from a recurring campaign, while applying your privacy and retention policy.
When an alert fires, first preserve the relevant logs and identify whether any login succeeded. Temporarily block or challenge abusive sources, revoke suspicious sessions, rotate affected credentials, and review administrator changes. If the origin is under load, act at the edge rather than adding a PHP plugin rule after the fact.
6. Keep core, themes, and plugins current
Outdated plugins and other software are a major attack category. A perfect login policy cannot compensate for a vulnerable component that lets an attacker bypass authentication or execute code. Maintain a written inventory of WordPress core, themes, plugins, the PHP runtime, and the web server.
- Review available updates on a schedule and subscribe to the security notices appropriate to the components you use.
- Back up the database and files before a significant update, and verify that the backup can actually be restored.
- Apply updates in a staging environment when the site is business-critical; test login, 2FA, publishing, forms, media uploads, cron jobs, and any XML-RPC-dependent service.
- Remove abandoned or unused plugins and themes instead of leaving them disabled but present.
- After updating, inspect the login and WAF logs for new errors or unexpected requests.
7. Treat a changed login URL as noise reduction, not security
A plugin that changes the visible login path can reduce automated requests aimed at the default URL, but it does not replace HTTPS, 2FA, rate limiting, updates, or a WAF. The underlying authentication system still exists, and an attacker who discovers the new path can target it. Obscurity can be a small operational benefit when the feature is maintained and compatible with your host, but do not make it the only control or rely on it for emergency access.
If you use such a feature, document the current path, test password reset and logged-out access, and ensure monitoring and WAF rules follow the new route. A forgotten custom URL can lock out the legitimate team without stopping a determined attacker.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.8. Add BasicAuth or an IP allowlist only with careful scope
A second prompt from web-server BasicAuth or an IP allowlist can stop traffic before WordPress runs. It is most practical for a private administration network, a fixed office address, or a VPN with a stable egress address. It becomes risky for travelling staff, contractors, mobile connections, and support providers whose addresses change.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Why blanket protection of /wp-admin/ can break the site
WordPress’s own hardening guidance warns that simply securing the whole /wp-admin/ directory may break functionality such as wp-admin/admin-ajax.php. The block editor, media interface, plugins, and front-end features can call that handler while a user is working. A rule that prompts for BasicAuth on every request may prevent those calls from completing, even though the administrator successfully passed the first WordPress login.
Scope and test the rule
- Decide whether the protection is for all administration, only the login script, or a specific private network.
- Start in staging and preserve an out-of-band hosting or console route in case the rule blocks everyone.
- Test logged-out redirects, the login form, 2FA, password reset, the dashboard, block editing, media uploads, plugin screens,
admin-ajax.php, scheduled tasks, and any API integration. - Review web-server logs for 401, 403, redirect-loop, and missing-resource errors.
- Roll out gradually and document every allowed network, exception, and recovery contact.
Do not publish a BasicAuth password in a shared script or rely on an IP allowlist without a way to reach the site after an ISP or VPN change. If staff need access from changing networks, a managed identity layer or VPN with controlled egress is usually easier to operate than a long list of addresses.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Choose controls by threat and operating conditions
| If your main concern is… | Start with… | Important limitation |
|---|---|---|
| Someone intercepting a password on an unsafe connection | Site-wide HTTPS and FORCE_SSL_ADMIN |
It does not stop a valid password being phished or reused |
| Password reuse or phishing | Unique passwords, mandatory 2FA, and preferably WebAuthn or passkeys | Recovery and device enrollment must be maintained |
| Large automated login floods | Edge WAF rate limits and challenges for both endpoints | Incorrect thresholds can affect real users; verify proxy address handling |
| XML-RPC password guessing | Disable XML-RPC when unused; otherwise restrict and rate-limit it | Blocking it can break required integrations |
| A small private site with a fixed office network | BasicAuth or an IP allowlist as an additional gate, plus the account controls | Changing addresses and admin-ajax.php compatibility require testing |
| Compromise through an old plugin or theme | Inventory, backups, prompt updates, and removal of abandoned components | Updates can introduce behavior changes, so test critical workflows |
A practical rollout order
- Confirm that the site and every administrative hostname work over HTTPS, then enable
FORCE_SSL_ADMIN. - Inventory administrators, remove unused accounts, issue unique passwords, and enroll every remaining administrator in 2FA.
- Enroll a second WebAuthn authenticator or passkey where supported, and verify recovery codes and the documented recovery owner.
- Apply edge or web-server limits to
/wp-login.phpand/xmlrpc.php; test normal login, lockout, password reset, and integrations. - Choose the XML-RPC policy: block it when unused, or create a narrow exception with monitoring and throttling.
- Enable WAF challenges and alerts, then verify that logs show the real client source and the rule that acted.
- Update core, themes, plugins, PHP, and the web server after taking a restorable backup; remove unused components.
- Only after the preceding controls work, consider a changed login path, BasicAuth, or an IP allowlist as supplemental defenses.
Troubleshoot common lockouts and failures
Administrators are redirected repeatedly or cannot stay logged in
Check the certificate, HTTP-to-HTTPS redirect, site URL settings, and reverse-proxy HTTPS signaling. A proxy that tells WordPress the request is HTTP while the browser is using HTTPS can create loops or invalidate cookies. Temporarily use the documented hosting recovery route, correct the scheme mismatch, and then retest in a new private browser session.
The dashboard loads but buttons or the editor fail
Inspect the browser network panel and server logs for blocked requests to wp-admin/admin-ajax.php or other admin resources. A blanket BasicAuth, IP rule, or WAF challenge may be intercepting those calls. Narrow the rule, provide the required authenticated exception, and retest media, editor, plugin, and front-end workflows rather than assuming the login page proves the configuration works.
A legitimate integration stops publishing
Check whether it uses xmlrpc.php. If so, replace a full block with a narrow allow rule and rate limit, confirm the integration’s source identity, and monitor its failed requests. If no integration is needed, leave the block in place and remove obsolete client configuration.
Rate limiting blocks the whole office
Verify whether many users share one public address and whether the proxy is forwarding the real client address. Lowering a global threshold can make a shared office appear to be one attacker. Use account-aware or authenticated exceptions where supported, keep the limit on failed attempts, and retain an administrator recovery path that does not depend on the blocked network.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteAn administrator loses a security key or phone
Use the documented recovery codes or the identity provider’s controlled recovery process, revoke the lost authenticator, enroll a replacement, and review recent login and administrator-change logs. Do not permanently disable 2FA for convenience; treat the event as a credential-recovery incident.
Maintenance checklist
- Verify HTTPS and the administration flag after certificate, proxy, or hosting changes.
- Review administrator accounts, 2FA enrollment, passkeys or security keys, and recovery contacts.
- Confirm that rate limits still cover
/wp-login.phpand/xmlrpc.phpand that thresholds match current traffic. - Re-test every documented XML-RPC integration after plugin, app, or WAF changes.
- Review WAF and authentication alerts for unusual failures, successful logins, and role changes.
- Apply and test core, theme, plugin, PHP, and web-server updates; remove components that are no longer maintained.
- Restore a backup periodically in a controlled environment so recovery is more than an assumption.
- Re-test any BasicAuth, IP allowlist, or custom login-path rule after network, staff, or workflow changes.
The strongest setup is not the one with the most prompts. It is the one that encrypts administration, makes a stolen password insufficient, stops abusive requests before they consume the origin, preserves required integrations, and gives the team a tested way back in when a control misfires.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
