How Many Times Is Your WordPress Login Page Attacked Every Day?

Security logs on a typical WordPress site record hundreds to thousands of automated login attempts every day. That number is not a sign that someone is after you specifically. It is a sign that your site’s login page is at a known address, and automated tools probe every known address they can find.

What is actually happening when you are “attacked”?

Botnets are networks of compromised computers, sometimes thousands of machines, running coordinated scripts. One common script is a brute-force attack on WordPress login pages. The script takes a list of common usernames and passwords, combines them in every possible way, and tries each combination against login pages.

The login page for WordPress is always at a predictable path. There is no secret about where it is. Every WordPress site on the internet has the same login URL structure. Botnets know this.

They do not need to research your site. They do not need to know anything about your business. They find WordPress sites, and they run the credential list against every one.

What does this look like on your server?

If you look at your security plugin’s blocked attempts log, you will see a list of IP addresses that attempted to log in and failed. On a typical small business site, that list has hundreds of entries per day. On a more visible site, thousands.

Each of those attempts required your server to receive the request, process it, check the credentials, and respond. Even a failed login attempt uses server resources. On shared hosting, hundreds of these per day add up to meaningful resource consumption.

Some hosts throttle or block login attempts at the server level. Some do not. On the hosts that do not, all of that automated traffic reaches your site’s processing layer.

What are the consequences of a successful attempt?

If a botnet guesses correctly, it gets into your WordPress dashboard as an administrator. From there, it can install malware, redirect your visitors, use your server to send spam, add hidden links to boost other sites’ SEO, or hold your site for ransom.

The average small business hack recovery costs about $14,500. That includes cleaning the infection, notifying affected parties if data was exposed, and restoring normal operation. Some recoveries are simpler. Some are far more expensive, especially if the site was processing payments or storing customer data.

Roughly 13,000 WordPress sites are hacked every day. Most of them were running a WordPress login page accessible to the public.

Can you protect against this?

Yes, partially. A login limit plugin blocks an IP address after a certain number of failed attempts, slowing the brute-force process. Two-factor authentication means a correct password alone is not enough. Moving the login URL away from the default address removes you from the most basic scanners.

None of these are complete solutions. They raise the cost of a successful attack. The attempts themselves continue regardless. Your server is still receiving and processing them.

The more permanent solution is a platform where there is no login page exposed to the public internet in the first place. No login page means no brute-force target.

For more on why WordPress is the most targeted platform for automated attacks, read why WordPress is the most targeted CMS for automated attacks. To understand the full bot traffic picture, read why bots are scanning your WordPress site around the clock.

Basalt moves small business websites off WordPress to a platform with nothing to hack and nothing to update. The move is free.

Find out what is wrong in 60 seconds

Or skip all this. Enter your web address and we will tell you exactly what is wrong with your site. Free, 60 seconds, no account needed.