My WordPress Login Page Is Being Attacked. What Should I Do?

If your login logs show hundreds of failed attempts, or your site is slowing down for no obvious reason, bots are trying to guess their way in. This is not personal. It happens to virtually every WordPress site, and it starts automatically, not because someone chose to attack you.

The good news is that a few changes stop most of it. The less good news is that stopping brute force attacks does not close the other doors.

What is actually happening?

WordPress uses the same login URL on every installation. Bots scan the web looking for that URL. When they find it, they begin testing username and password combinations.

These attacks are not run by a person sitting at a keyboard. They are automated, running around the clock, and they are not giving up. A bot that tries 1,000 passwords per minute against your site does not get tired.

The goal is access. An admin account gives an attacker full control: they can install plugins, modify files, access customer data, or use your site as a base for attacking others. Brute force is a numbers game, and bots have the patience to play it.

The default target on every WordPress site

WordPress puts the login page at a predictable address by default. Because the same software runs on millions of sites, bots know exactly where to look. They do not need to discover your login page. They already know where it is.

This is one reason roughly 13,000 WordPress sites are hacked every day. The predictability makes automated attacks efficient. Moving the target, or making it much harder to guess, disrupts the automation.

What you can do today

1. Change your login URL. Several plugins can move the login page to a custom address. This alone stops most automated attacks because bots are looking for the default location.

2. Install a login limiter. A plugin that locks out an IP address after five failed attempts makes brute force attempts impractical. Bots trying thousands of combinations need thousands of attempts.

3. Enable two-factor authentication. Even if a bot guesses your password, two-factor means they still cannot get in without your phone or authentication app. This is one of the highest-value security changes you can make.

4. Disable XML-RPC if you do not use it. This is an older feature that bots exploit to run brute force attacks much faster than the login page allows. Your host or a security plugin can disable it. More detail on XML-RPC in a separate article.

5. Check your existing passwords. If any admin account uses a simple password, change it now. A strong, unique password takes brute force from days to years.

Why this keeps happening

Changing the login URL and adding two-factor are patches, not cures. They protect against brute force attacks specifically. They do not address the other 91 percent of the attack surface.

In 2025, researchers logged 11,334 new WordPress security holes. Brute force attacks exploit none of those holes. They exploit weak passwords and predictable URLs. A site hardened against brute force can still be compromised through a plugin vulnerability that has nothing to do with the login page.

These are separate problems that require separate solutions. Solving the login problem is genuinely worth doing. It just does not solve the full picture.

Basalt moves small business websites off WordPress to a platform with nothing to hack and nothing to update. The move is free. On a platform without a WordPress login page and without plugins, the brute force attack surface and the plugin attack surface both disappear.

Find out what is wrong in 60 seconds

Or skip all this. Enter your web address and we will tell you exactly what is wrong with your site. Free, 60 seconds, no account needed.