If you look at the access log of almost any WordPress site, you will see repeated requests to wp-login.php and xmlrpc.php from addresses all over the world. These are automated password-guessing attacks. They are rarely targeted at you personally, but they will succeed against weak passwords, and they consume server resources.
1. Strong, unique admin passwords
No guessing attack beats a long unique password. Make sure every administrator account has one, and remove admin rights from users who do not need them.
2. Two-factor authentication
A security plugin can add a second factor to the WordPress login, so a guessed password alone is not enough.
3. Limit login attempts
Block an address after a few failed logins. Many security plugins do this, and server-side tools can block at the firewall before WordPress even loads.
4. Disable XML-RPC if you do not use it
XML-RPC lets attackers try many passwords in a single request. Unless you use the WordPress mobile app or a service that needs it, disable it.
5. Do not use "admin" as a username
Attackers try "admin" first. Create a new administrator with a different name and delete the old one, assigning its posts to the new user.
6. Add a CAPTCHA or challenge
A challenge on the login form stops most bots without bothering real users.
7. Keep WordPress updated
Brute force is only one route. Outdated plugins are another, often easier one.
Why it matters for speed
Thousands of login attempts each start PHP and query the database. Blocking them early keeps your site fast for real visitors and within your hosting resources.
At IDX
Our support team can help you review login protection on your IDX hosting account. For more, read WordPress security essentials and our guide to securing your cPanel account.
IDX on digital infrastructure
Back to blog →