Stop Brute-Force Attacks: Limit WordPress Login Attempts
Brute-force attacks hammer your WordPress login page with thousands of password guesses. Here’s how to stop them fast.
A brute-force attack is exactly what it sounds like: a bot tries thousands of username and password combinations against your WordPress login page until something works. By default, WordPress lets bots try as many times as they like. That single gap is responsible for a huge share of hacked sites. The good news is that closing it takes about ten minutes and requires no coding.
Why Brute-Force Attacks Are So Common on WordPress
WordPress powers a large portion of the web, which makes it a high-value target. Automated bots scan the internet continuously, looking for the standard login URL (`/wp-login.php`) and the XML-RPC endpoint (`/xmlrpc.php`). XML-RPC is a legacy remote-access feature that, if left open, can be used to fire hundreds of login attempts inside a single request, bypassing simple rate limits. Both entry points need to be addressed.
Step 1 — Limit Login Attempts with a Plugin
The fastest fix is to install a plugin that locks out an IP address after a set number of failed logins. Limit Login Attempts Reloaded is a well-maintained, free option available in the official WordPress Plugin Directory. After installing and activating it, go to Settings > Limit Login Attempts in your dashboard.
- Set Allowed Retries to 3 or 4 failed attempts.
- Set Minutes Lockout to at least 20 minutes for the first lockout.
- Increase the lockout duration after repeated offences (e.g. 24 hours after 4 lockouts).
- Enable GDPR compliance if your site serves EU visitors.
- Save changes and check the Logs tab after a day to see blocked IPs.
Step 2, Block or Disable XML-RPC
xmlrpc brute force attacks are particularly dangerous because one HTTP request can bundle hundreds of login attempts. Unless you use a mobile app, Jetpack, or a third-party service that specifically requires XML-RPC, disabling it is the safest choice.
The cleanest way to disable XML-RPC without touching code is through a plugin. Disable XML-RPC (available on wordpress.org) does exactly one thing and does it reliably. Install it, activate it, and you are done, no settings page needed.
Step 3, Change the Default Login URL
Bots target `/wp-login.php` because it is the same on every WordPress site. Changing the login URL to something unpredictable means most automated scanners never find the page at all. Plugins such as WPS Hide Login let you set a custom path (for example, `/my-site-access`) directly from Settings > WPS Hide Login. Write the new URL down somewhere safe before saving, if you forget it, you will be locked out of your own site.
Step 4, Enable Two-Factor Authentication
Two-factor authentication (2FA) requires a second proof of identity, usually a time-sensitive code from an app like Google Authenticator, in addition to a password. Even if a bot guesses your password correctly, it cannot log in without that second code. Most security plugins (Wordfence, Solid Security) include 2FA. Enable it for all administrator accounts at minimum.
Step 5, Force HTTPS on Your Login Page
wp force ssl refers to making WordPress redirect all traffic, especially login traffic, over an encrypted HTTPS connection. Without it, login credentials can be intercepted on public networks. If your host has not already enforced HTTPS site-wide, go to Settings > General and update both the WordPress Address and Site Address fields to start with `https://`. Your host's control panel usually has a one-click SSL toggle as well.
Quick Comparison: Protection Methods
| Method | Difficulty | Stops Bots | Free Option Available |
|---|---|---|---|
| Limit login attempts plugin | Easy | Yes | Yes |
| Disable XML-RPC | Easy | Yes (XML-RPC attacks) | Yes |
| Custom login URL | Easy | Mostly | Yes |
| Two-factor authentication | Easy-Medium | Yes | Yes |
| Force HTTPS (SSL) | Easy | Partial (encrypts credentials) | Yes (via host) |
| Web Application Firewall (WAF) | Medium | Yes (comprehensive) | Freemium |
If Your Site Has Already Been Compromised
Limiting login attempts prevents future attacks, but it does not clean up damage that has already been done. If you are seeing unfamiliar admin accounts, strange redirects, or your host has suspended your site for malware, the infection needs to be removed before hardening makes sense. Our team handles this daily, WordPress Malware Removal is the fastest way to get a clean site back without risking further damage.
A brute-force attack on WordPress is one of the most preventable threats a site owner faces. Install a login-limiting plugin, disable XML-RPC if you do not need it, change your login URL, and turn on 2FA for admin accounts. Each step takes minutes and stacks on top of the others. Do all four and you have removed the vast majority of automated attack risk without touching a single line of code.
How do I know if my site is being brute-forced right now?
Check your server error logs or install Limit Login Attempts Reloaded and look at its Logs tab. A large number of failed login attempts from the same or rotating IP addresses is a clear sign. Some hosts also show unusual traffic spikes in their dashboards.
Will limiting login attempts lock me out of my own site?
Only if you repeatedly mistype your own password. Most plugins whitelist your IP address automatically, or let you add it manually in settings. If you do get locked out, you can clear the lockout by logging into your hosting control panel and deactivating the plugin via the file manager or FTP.
Is XML-RPC always a security risk?
Not always, but it is a common attack vector. If you do not use Jetpack, the WordPress mobile app, or a third-party service that requires it, disabling XML-RPC is the safest choice. If you do use those services, a firewall rule that blocks XML-RPC login attempts (while allowing other XML-RPC calls) is a reasonable middle ground.
Does a Web Application Firewall (WAF) replace these steps?
A WAF adds a powerful extra layer by blocking malicious traffic before it reaches WordPress at all. Services like Cloudflare offer a free tier with basic bot protection. However, a WAF works best alongside login limiting and 2FA, not instead of them.
My site was already hacked. Should I still do these steps?
Yes, but clean the infection first. Hardening a compromised site without removing the malware is like changing the locks while a burglar is still inside. Start with WordPress Malware Removal, then apply these protections once the site is clean.
Does changing the login URL break anything?
It should not break your site, but you must save the new URL somewhere secure before activating it. If you forget the custom path, you will need to deactivate the plugin via FTP or your host's file manager to regain access. Some caching plugins also need to be told to exclude the new login path from caching.