This is part two of the Lucid Cloud Platform WordPress security series. If you are just getting started, begin with the complete WordPress security guide.
Your login page is the front door to your website, and it is the first place automated attacks come knocking. The good news is that securing it is mostly about a few simple habits, none of which need a developer. This guide goes deeper on locking down WordPress logins, and on two-factor authentication, the single most effective step you can take.
Why logins are the main target
Most attacks on WordPress are not clever. They are automated tools trying huge lists of common usernames and passwords against the login page, thousands of times a minute, across millions of sites. They are not targeting you personally, they are simply looking for a door that opens easily. Make yours difficult and they move on. Almost everything below is about turning your front door from an open invitation into a locked one.
Use strong, unique passwords
A weak or reused password undoes every other protection. If the same password guards your email, your bank and your website, a leak anywhere puts all three at risk. Give every account a long, random password and store it in a password manager, so you never have to remember or reuse one. A password manager also fills them in for you, which makes good security easier than bad security.
Retire the “admin” username
Attackers already know that a huge number of sites have a user called “admin”, so using it hands them half of the login for free. If you have an “admin” account, create a new administrator with a different name, log in as that user, and delete the old one. It is a two-minute job that removes an obvious target.
Limit login attempts
By default, WordPress will let a bot guess passwords endlessly. Capping the number of failed attempts, and locking out an address that keeps trying, shuts brute-force attacks down almost entirely. Most security plugins offer this in a couple of clicks, along with a short delay after each failure that makes automated guessing impractical.
Turn on two-factor authentication
This is the big one. Two-factor authentication, often shortened to 2FA, means a password alone is no longer enough to log in. After entering it, you confirm a short code from an app on your phone, so even a stolen or guessed password is useless without your device in hand.
Where possible, use an authenticator app rather than text-message codes. App-based codes are more secure, since text messages can in rare cases be intercepted or redirected. Turn 2FA on for every administrator account without exception, and encourage editors and other trusted users to do the same. The few seconds it adds at login are nothing against the protection it gives.
Do not share accounts
It is tempting to let everyone share one login, but it is a bad idea. Shared accounts cannot have their own two-factor protection, and when someone leaves you cannot remove their access without disrupting everyone else. Give each person their own account with only the access they need, and you keep both control and a clear record of who did what.
Keep the login page quiet
You can reduce unwanted attention on the login page itself. A simple challenge on the form stops most bots from ever reaching it, and monitoring failed login attempts, which a good security plugin will report, tells you early if someone is taking a serious run at your site. None of this replaces the steps above, but together they keep the front door firmly shut.
The full WordPress security series
- The complete WordPress security guide for small businesses (start here)
- Part 2: Logins and two-factor authentication
- Part 3: Choosing safe themes and plugins
- Part 4: Backups and recovery
