Login Manager

wp-login.php is the most attacked URL on any WordPress site. Not because it is weak, but because it is at a known address on millions of sites, which makes it worth attacking automatically and continuously. Most owners discover this from a log file rather than a breach.

These guides cover the defences, roughly in order of how much they help. Moving the login URL removes you from the easiest scans. Limiting attempts stops the patient ones. Allowlisting your own addresses and blocking the worst offenders narrows it further. A captcha stops most automated submissions, and two-factor authentication is the one that still protects you when a password has already leaked.

Each of those has a failure mode, and they are covered too. A custom login URL that a cache serves to the wrong person or that returns 404 after a permalink change. A URL you moved and then forgot. Attempts that continue after the move because something is still reaching the old file directly.

One group is about being locked out, which is the risk you take on when you harden a login. Losing the phone with the authenticator on it, a redirect loop after a correct password, sessions that end after minutes, cookies the browser will not set.

If you are hardening a site today, read the recovery articles before the hardening ones. Knowing the way back in is what makes the rest safe to do.