How to secure your WordPress login
The wp-login.php page is a favourite target for bots that hammer your admin with password guesses around the clock. On shared hosting these attacks also eat your account limits, so the site slows down or hits a resource error. Below are practical steps that lock down WordPress login without heavy plugins or crutches.
Check your site
-
Drop the admin username and set a strong password
Go to Users > All Users. If there is a user called admin or one matching your domain, create a new administrator with a unique name, log in as that user, and delete the old one, assigning its posts to the new account. Make the password long (16+ characters) from a generator, not a memorable word.
-
Limit login attempts
Stock WordPress lets bots guess passwords endlessly. Install a plugin like Limit Login Attempts Reloaded: after a few failed tries the IP is locked out for a while. If your hosting runs Imunify360, it filters some brute force before WordPress, but the plugin is still a useful extra layer.
-
Turn on two-factor authentication (2FA)
2FA adds a one-time code from an app (Google Authenticator, Authy) on top of the password. Even if the password leaks, no one gets in without the code. The free Two-Factor or WP 2FA plugin works well; enable 2FA at least for every administrator and editor role.
-
Hide or lock down wp-login.php
Change the login URL with a plugin like WPS Hide Login so bots cannot find the default wp-login.php. A stronger option is to protect the login at the server level: in cPanel open Directory Privacy and password-protect the wp-admin folder, or restrict wp-login.php by IP in .htaccess if your address is static.
-
Add security headers in .htaccess
Headers shield the login form from clickjacking (loading it in a hidden iframe) and needless leaks. In the .htaccess in your site root add:
Header always set X-Frame-Options SAMEORIGIN
Header always set X-Content-Type-Options nosniff
Header always set Referrer-Policy strict-origin-when-cross-origin
On HTTPS add Strict-Transport-Security too. On LiteSpeed these lines work without extra modules. -
Keep WordPress updated and disable the file editor
Most hacks come not from guessed passwords but from holes in outdated plugins and themes. Enable auto-updates for core and plugins, and remove unused themes. In wp-config.php add define('DISALLOW_FILE_EDIT', true); so even with access an attacker cannot edit theme code straight from the dashboard.
How to verify the result
Check that the old password and a login without 2FA no longer get into the dashboard, and that the IP is blocked after a few wrong attempts. To confirm the security headers on the login page, run it through the free TechGuard headers checker: it gives a grade from A+ to F and shows which headers are still worth adding.
Tip: Do not password-protect the whole wp-admin folder with Directory Privacy without an exception for admin-ajax.php, or forms, filters, and other AJAX features on the public part of the site will break.