WordPress's login address is the same on every site in the world: /wp-admin and /wp-login.php. That means any automated scanner knows where to knock without having to look — and it knocks, day and night, on every site it finds.
Most of the time it goes no further than that. But one weak password is all it takes for it to stop being noise and become a problem. There are three things to do, in order of effect.
1. First of all: the password and the second step
None of the tricks below replaces this. If the administrator password is guessable, hiding the door only slows down whoever is trying.
| 1 |
Delete the «admin» user if it still exists. Half the attempts a site receives use exactly that name. Create a new administrator under another name, and remove the old one, reassigning its content.
|
|
| 2 |
A long password, used only on this site. A five-word phrase beats eight characters with symbols, and it is not repeated on the e-mail or anywhere else.
|
|
| 4 |
One account per person, with the right role. Someone who only writes articles does not need to be an administrator. And when someone leaves, the account goes.
|
|
2. Changing the login address
This is not real security — it is housekeeping. Moving /wp-login.php to an address only you know means automated scanners stop hitting it, and the site stops spending resources answering them. On noisy sites you can even see it in the speed.
It is done with a plugin built for it, and the change is immediate.
|
Write the new address down before saving. The moment you save, the old one stops working. Close the window without having noted the new one and you are locked out of your own site — the way back is deactivating the plugin through File Manager, by renaming its folder. Write the new address down before clicking save.
|
3. A password before the password
This is the most effective of the three, and it belongs to cPanel rather than WordPress: protecting the wp-admin folder with a server-level password. Anyone arriving has to pass a browser box before WordPress even starts — meaning the attempts never get to consume PHP at all.
| 1 |
In cPanel, open Directory Privacy.
|
|
| 2 |
Navigate to the public_html/wp-admin folder and choose to protect it.
|
|
| 3 |
Create a username and password — different from the WordPress ones — and save.
|
|
|
Two things break with this, and both have a fix. The file admin-ajax.php lives inside wp-admin and is used by plugins on the public side of the site — forms, carts, filters. Protected, those stop working. The fix is to add an exception for that file in the .htaccess cPanel created. If the site starts throwing odd errors after this, common WordPress errors helps confirm that this was it.
|
Restricting by address: only with a fixed IP
You can allow only a few addresses and refuse everyone else. It is the strongest protection there is — and the one that locks the most people out of their own site, because hardly anyone has a fixed address: home connections change, mobile data always changes, and from then on not even you get in.
It is only worth it if you always work from the same office on a contracted fixed address. If you do lock yourself out, the rule is removed through File Manager — and for how the mechanism works, see why your IP gets blocked.
And the rest of the site
Protecting the door achieves nothing while an out-of-date plugin serves as a back entrance. Updates remain the first defence — see what we do about security and what stays on your side. If you cannot get into the dashboard right now, the cause is usually something else: cannot get into the WordPress dashboard.
|
Want us to look at the login attempts on your site with you?
Talk to us
|
Angola
Brasil
Kenya
Moçambique
Nigeria
Portugal
South Africa
United Kingdom
United States
International
