You install a security plugin, open its log a day later, and find hundreds of failed logins from addresses you have never heard of, trying usernames like “admin”, “administrator” and your own name. Nobody got in. But it is unsettling to see, and it raises a fair question: is this normal, and what should you actually do about it?
It is normal. This is a brute-force attack, and almost every WordPress site on the internet receives them. The good news is that stopping them does not need anything exotic, only a few settings that most sites never get round to.
What a brute-force attack actually is
A brute-force attack is automated guessing. A script takes a list of common usernames and a long list of leaked or common passwords, and tries them against your login page one after another, around the clock. It is not a person who has chosen your business. It is software working through thousands of sites at once, looking for the ones that will open.
WordPress is a popular target because every site has the same login address, /wp-login.php, and by default WordPress does not limit how many times someone can try to log in. A second door, xmlrpc.php, can accept login attempts too, and attackers use it because it can test many passwords in a single request.
Two kinds of harm come from this. The obvious one is a successful guess, which gives the attacker your site. The less obvious one is load: thousands of login attempts each make your server do real work, and on cheap shared hosting that alone can make the site slow or briefly unavailable for genuine visitors.
Signs your site is being targeted
- A security plugin shows long lists of failed logins, often for usernames that do not exist on your site.
- Your host warns you about high resource use, or suspends the site temporarily, without any increase in real traffic.
- The login page itself is slow while the rest of the site seems fine.
- Server access logs show repeated POST requests to
wp-login.phporxmlrpc.phpfrom many different addresses.
None of these means you have been hacked. They mean someone is knocking. What matters is whether any door would open.
The fixes, in order of how much they help
1. A strong, unique password for every administrator
This is the one that actually decides whether a brute-force attack can succeed. Guessing scripts rely on passwords that are short, common, or reused from another site that was breached. A long password generated by a password manager, used nowhere else, is not realistically guessable this way. Check every administrator account, not just your own. The account that gets broken into is usually the one nobody remembers: a former developer, an old staff member, a test user.
2. Do not use “admin” as a username
Scripts try “admin” first because so many sites still have it. If yours does, create a new administrator with a different username, log in as that user, and delete the old one, assigning its posts to the new account when WordPress asks. On its own this is not security, since usernames can often be discovered, but it removes you from the easiest list.
3. Limit login attempts
Because WordPress allows unlimited tries, add a limit. A login-limiting plugin, or the login protection inside a full security plugin, locks out an address after a handful of failures for a period of time. This turns thousands of guesses an hour into a few, which makes guessing hopeless and takes most of the load off your server.
4. Turn on two-factor authentication
With two-factor authentication, a correct password is not enough. The person logging in also needs a code from an app on their phone. Even if a password leaks, the attacker still cannot get in. It is the single most effective protection for administrator accounts, and it takes a few minutes to set up per user.
5. Deal with xmlrpc.php
Most small business sites do not need XML-RPC at all. It was built for remote publishing tools, and modern ones use a different method. If nothing on your site depends on it, blocking it closes the second door. Check first, though: some mobile apps and a few plugins still use it, and blocking it without checking can quietly break them.
6. Block attacks before they reach WordPress
Everything above happens inside WordPress, which means your server still receives every attempt. A firewall at the hosting or network level, such as a web application firewall or the protection some hosts include, can stop known attacking addresses before WordPress even loads. This is what helps most with the slowdown problem rather than the guessing problem.
What not to bother with
Some advice sounds strong but adds little. Blocking individual IP addresses by hand is endless, because the attacks come from thousands of them and they change constantly. Renaming the login URL hides the door from lazy scripts, but it is not a lock, and it can confuse you and your team later. It is fine as an extra, never as the main protection. And CAPTCHAs on the login page slow down bots a little and slow down you every single time, when a login limit plus two-factor authentication does the job better.
If you think someone has already got in
Look for administrator accounts you did not create, posts or pages you did not write, plugins you did not install, or a site that redirects visitors somewhere else. If you see any of these, the attack is no longer a guessing problem. Change every password from a clean device, and follow the steps in how to fix a hacked WordPress website before doing anything else.
A short checklist
- Every administrator has a long, unique password from a password manager.
- No account is called “admin”, and old accounts are removed.
- Login attempts are limited.
- Two-factor authentication is on for every administrator.
- XML-RPC is blocked if nothing depends on it.
- WordPress, plugins and themes are kept up to date, as described in our guide to core, plugin and theme updates.
This post is the first in a series on website security for small businesses. For the wider picture, start with our website security best practices and the WordPress security checklist for small businesses.
If you would rather have someone check this properly, our website security audit and hardening starts from ₹1,999 and covers login protection along with the rest of your site’s weak points. You get a clear list of what we found before anything is changed.
Next in this series: WordPress Two-Factor Authentication: How to Set It Up
