Posts

A custom login 404 may come from the CDN, server, WordPress rewrites, a disabled route, or a slug collision. Locate the layer, repair the mapping, and purge narrowly.

Interpret WordPress login logs as a timeline: define recorded events, normalize time, verify client attribution, correlate account changes, and preserve evidence.

Use a temporary WordPress login IP block only with reliable client-address evidence, narrow scope, monitoring, expiry, and account controls that survive a network change.

Allowlist a WordPress login IP only after verifying client-address handling, stable network ownership, narrow scope, expiry, and an untrusted-path control.

Fix an invalid reCAPTCHA site key by matching the public key, secret, hostname, and integration type. Remove stale copies and rotate any exposed secret.

Add reCAPTCHA to WordPress login with the correct integration type, environment-specific keys, anonymous testing, accessible failure handling, and a recovery route.

Recover WordPress access after losing a 2FA device through recovery codes, another factor, a trusted session, or a verified administrator reset—never a global shutdown.

Add two-factor authentication to WordPress without locking out legitimate users. Plan enrollment, recovery, enforcement, testing, and secure factor resets.

Slow password guessing with temporary, measurable WordPress login limits. Account for shared networks, proxies, recovery, distributed attacks, strong passwords, and 2FA.