Two-Factor and Login Hardening for WordPress

Right now, somewhere, a script is trying to log into your site.

Not because anyone chose you. Because automated tools crawl the entire web attempting common username and password combinations against wp-login.php on every WordPress installation they find. It's constant, it's cheap, and it runs whether you have ten visitors a month or ten thousand.

Almost all of it fails. The five changes below make it fail reliably — and the first one does most of the work.

The short version

In order of return:

1. Two-factor authentication on every admin account
2. No admin username
3. Strong, unique passwords via a password manager
4. Rate limiting on login attempts
5. Least privilege — fewer administrators

Everything else — hiding your login URL, IP allowlisting, CAPTCHAs — is optional refinement.

1 — Two-factor authentication

The single highest-return security change available to a WordPress site.

It makes a stolen or guessed password insufficient on its own. Given that credential reuse is one of the main compromise routes — a password from a breached site elsewhere being tried on yours — this addresses the failure mode that strong passwords alone can't.

How to set it up: the Two Factor plugin, maintained by WordPress core contributors, is a reasonable free option. Most security plugins (Wordfence, Solid Security) include it too. If you already run one, use its version rather than adding another plugin.

Which method:

An authenticator app (TOTP) is the sensible default — Authy, Google Authenticator, 1Password, or your password manager. Works offline, no phone signal needed.

Email codes are better than nothing, but weaker: if your email is compromised, so is your site. And on WordPress specifically there's a practical problem — plenty of sites can't reliably send email, so your login code may never arrive. Why that happens.

SMS is the weakest of the three and worth avoiding where an app is available.

Save your backup codes. Somewhere that isn't your phone. Losing your authenticator without backup codes means recovering access the hard way.

Apply it to every administrator, not just yourself. An admin account without 2FA is the gap someone walks through.

2 — Stop using admin

admin is the first username every automated attempt tries. Using it means an attacker only has to guess one thing instead of two.

To change it, since WordPress won't let you rename a user directly:

1. Create a new Administrator account with a different username and a strong password
2. Log out, log in as the new account
3. Delete the old admin account, choosing to attribute its content to the new user rather than deleting it

Also worth knowing: WordPress can leak usernames through author archives — yoursite.com/?author=1 often redirects to /author/username/. Several security plugins block this, and noindexing author archives on a single-author site handles the search-visibility half of it. That setting.

Your display name and your login username don't have to match, and shouldn't.

3 — Passwords, properly

Use a password manager. Not because long passwords are magic, but because it makes unique passwords effortless — and uniqueness is what stops someone else's breach becoming yours.

Generate, don't invent. Human-chosen passwords are more predictable than they feel.

Require it of every user, not just admins. An Editor account with a weak password is still a way in.

Change credentials after any staff departure or any suspected compromise.

4 — Rate limiting

Limiting failed login attempts turns brute force from an ongoing background risk into a non-event. After a set number of failures from one IP, further attempts get blocked for a period.

Where you'll find it: built into most security plugins, or available standalone via Limit Login Attempts Reloaded.

Sensible settings: four or five attempts before a temporary lockout, a lockout period of fifteen to sixty minutes, and a longer block after repeated lockouts.

Does it lock out real users? Occasionally, and less than people fear. Someone genuinely mistyping their password four times in a row is uncommon, and the lockout expires. The genuine risk is locking out yourself while troubleshooting — which is why the recovery routes are worth knowing before you need them.

Allowlist your own IP if it's static. Saves the most likely lockout.

5 — Fewer administrators

Not everyone who works on your site needs Administrator access.

Editor can create, edit, publish, and delete any post. That's enough for most writers.

Author can publish their own posts.

Contributor can write but not publish.

Administrator can install plugins, edit files, and change every setting — which means an Administrator account is a full compromise if it's taken.

Audit your user list now. Old contractors, agency accounts from a project that ended, a developer who set the site up three years ago. Every dormant admin account is an unnecessary door, and nobody notices them because nothing breaks.

Should you change the login URL?

Genuinely optional, and it's worth understanding what it does and doesn't achieve.

Moving wp-login.php to something like /my-login stops automated scripts that only ever try the default location. That's a real reduction in log noise and in the volume of attempts you see.

But it's obscurity, not security. A determined attacker can find the new URL through other means, and it does nothing against credential reuse or a plugin vulnerability.

The real cost is lockout risk. Forget the custom URL, or have a plugin conflict break it, and you've locked yourself out of your own site.

My position: do 2FA first. If you've done everything above and want less log noise, change the URL and write it down somewhere you'll find it. If you haven't done 2FA yet, that's where your effort should go.

What about CAPTCHAs?

Reasonable on login and comment forms, with a caveat: they add friction for real users and third-party JavaScript to your page.

Invisible options (reCAPTCHA v3, Cloudflare Turnstile) avoid most of the friction. Turnstile is generally the better privacy choice.

Lower priority than everything above.

The five-minute version

If you only do one thing today: enable 2FA on every administrator account.

If you have ten minutes, add this:

• 2FA enabled on every admin account, backup codes saved somewhere safe
• No account named admin
• Password manager in use, unique password per site
• Rate limiting on, with your own IP allowlisted if static
• User list audited, dormant accounts removed, roles downgraded where possible

That's a genuinely hardened login, and it takes one sitting.

Frequently asked questions

Should I change the login URL?
It's optional and it's obscurity rather than security. Moving wp-login.php stops automated scripts that only try the default path, which reduces log noise and attempt volume — but it does nothing against credential reuse or plugin vulnerabilities, and a determined attacker can find the new URL. The real cost is locking yourself out if you forget it or a plugin conflict breaks it. Enable two-factor authentication first; that's where the actual protection is.

Is 2FA worth the hassle?
Yes, and it's the highest-return security change available to a WordPress site. It makes a stolen or guessed password insufficient on its own, which addresses credential reuse — one of the main routes into small sites, and one that strong passwords alone can't prevent. With an authenticator app the ongoing friction is a six-digit code at login. Save your backup codes somewhere separate from your phone.

Does limiting login attempts lock out real users?
Occasionally, and less than people expect — genuinely mistyping a password four times in a row is uncommon, and lockouts expire after a set period. The more likely victim is you, while troubleshooting something. Allowlist your own IP if it's static, and know the recovery routes before you need them. The reduction in automated attempts is worth the small risk.

What to do next

Enable 2FA on your own admin account right now. It takes about five minutes with an authenticator app, and it's the change that makes the most difference.

Then look at your user list. Most sites have at least one dormant administrator account — an old contractor, a previous agency, a developer from years ago — and those are doors nobody remembers leaving open.

Free: The WordPress maintenance checklist.

---

Related guides

• WordPress security without a sysadmin — the wider picture
• Locked out of wp-admin — if hardening goes wrong
• Auditing plugins for security risk — the bigger exposure
• WordPress emails not sending — why email 2FA codes may not arrive