Two-Factor and Login Hardening for WordPress

Login attacks against WordPress are constant, automated and indiscriminate. Every public WordPress site receives them, regardless of size or traffic, because the cost of trying is near zero.

They are also the least successful route into a WordPress site. Vulnerable plugins account for more compromises than password guessing, which is worth holding onto — login hardening is worth doing and it is not the whole job. The full picture.

Five measures, ordered by effect against the friction they cost.

---

1. Two-factor authentication

The single most effective login measure, and the only one worth real friction.

It defeats brute force and credential reuse simultaneously. Even a leaked, reused password is not enough on its own.

What to use:

• An authenticator app — a rotating code from a phone. Free, works offline, and the sensible default
• A hardware key — a physical device. Strongest, and appropriate where the site matters commercially
• Email codes — better than nothing and the weakest option, since email is often the thing an attacker already has
• Not SMS, where avoidable. SIM swapping is a real attack and SMS codes are the softest second factor

Where to enable it: most security plugins include two-factor, and dedicated plugins do it more simply. Either is fine.

Enable it for every administrator and editor. A second factor on your account and not on the other administrator's leaves the door open at the weakest account.

Save the recovery codes somewhere outside the site. Losing the authenticator without them means a database-level reset. The recovery routes.

---

2. Unique passwords, from a manager

Unique matters more than complex.

A long random password used nowhere else cannot be leaked from anywhere else. A complex password reused across three services is compromised as soon as the weakest of them is.

Practically:

• Use a password manager. Generated, unique, stored, and never retyped
• Length beats character classes. A long passphrase outperforms a short string of symbols
• Change any password you have used elsewhere, particularly if it predates your using a manager

Credential reuse is a top route into WordPress sites and it does not require anyone to attack you at all — the leak happens somewhere else and the credentials are tried everywhere.

---

3. Rate limiting

Blocking an address after a handful of failed attempts stops automated attacks cheaply, and it costs a legitimate user nothing unless they genuinely fail repeatedly.

Sensible configuration:

• Five failed attempts before a temporary block
• A short lockout first — twenty minutes — escalating on repetition
• Block by IP, with a whitelist for your own address if it is static
• Log the attempts. The log is diagnostic when something goes wrong

Most security plugins include this, and it is one of their genuinely valuable features.

One caution: aggressive settings lock out real users, particularly on shared office connections where several people appear as one address. Five attempts is enough to stop automation and generous enough for a person having a bad morning.

---

4. No account named admin

Half of every automated guess is the username, and admin is the free half.

If you have one:

1. Create a new administrator with a different username
2. Log in as the new account
3. Delete the old admin account, attributing its content to the new one

Do not simply change the display name. The login username is what matters, and it is not editable after creation — a new account is the only route.

Also worth knowing: WordPress author archives can expose usernames, and the REST API lists users by default on some configurations. Neither is catastrophic, and both mean a username should not be treated as a secret.

---

5. Least privilege

Most WordPress sites have more administrators than they need, and each one is a full route in.

The roles, briefly:

Role	Can
Administrator	Everything, including installing code
Editor	Publish and manage all content
Author	Publish their own posts
Contributor	Write, not publish
Subscriber	Read, manage own profile

Two rules:

• A person who does not install plugins does not need administrator. Editor covers content work entirely
• Remove accounts for people who have left. This is the most common finding in any account review, and old accounts are attractive precisely because nobody is watching them

Review accounts monthly. It takes two minutes.

---

What matters less than its reputation

Changing the login URL. It stops unsophisticated scanners hitting /wp-login.php and does nothing against anything targeted, since the login is discoverable by other means. It also locks people out regularly and breaks integrations expecting the standard path. Do it if you want; do not count it as security.

Hiding the WordPress version. The version is inferable from other signals, and an attacker running a vulnerability scanner does not need it.

Disabling XML-RPC blindly. It has been used for amplified brute force, and it is also used by legitimate applications, some mobile apps and services like Jetpack. Disable it if you are certain nothing needs it, and know that "certain" means checking.

CAPTCHA on login. Adds friction for people and is defeated by anything sophisticated. Rate limiting achieves more for less.

---

Applying it

In order, and the first two are most of the benefit:

1. Enable two-factor for every administrator and editor, storing recovery codes off-site
2. Move every password into a manager, generating new unique ones
3. Configure rate limiting at five attempts with a short escalating lockout
4. Replace any admin account
5. Review roles, downgrading anyone who does not install code
6. Remove accounts for people who have left
7. Set a monthly reminder to review accounts and read the login log

---

Frequently asked questions

Should I change the login URL?
It stops unsophisticated scanners and does nothing against a targeted attack, while locking people out regularly and breaking integrations. Two-factor authentication and keeping plugins updated matter far more. Do it if you want, but not instead of those.

Is 2FA worth the hassle?
Yes, and it is the only login measure worth real friction. It defeats brute force and credential reuse at once, so even a leaked reused password is not enough alone. Use an authenticator app rather than SMS, and store recovery codes outside the site.

Does limiting login attempts lock out real users?
It can if configured aggressively, particularly on shared office connections where several people share one address. Five attempts with a short escalating lockout stops automation while remaining generous to a person mistyping.

Can I change my WordPress username?
Not directly — the login username is fixed after creation. Create a new administrator with the username you want, log in as it, then delete the old account and attribute its content to the new one.

Is SMS two-factor good enough?
Better than none and the weakest option. SIM swapping is a real attack, which makes SMS the softest second factor. An authenticator app is free, works offline and is not vulnerable to it.

Do I need a security plugin for two-factor?
No. Dedicated two-factor plugins do it more simply than a full security suite, and either works. If you already run a security plugin, check whether it includes two-factor before adding another plugin for it.