The login screen receives more automated traffic than anything else on your site. If you have already made the account itself solid, those attempts are unlikely to succeed — but two problems remain: the server resources they consume, and the fact that unlimited guesses eventually get somewhere. This part deals with both.
1. Rate limiting — switch this on first
By default WordPress does not count failed logins. The same source can keep trying indefinitely. Rate limiting puts a ceiling on that: after a set number of failures, further attempts from that source are refused for a while.
That single change matters more than it sounds. Once there is a ceiling on attempts per hour, guessing a password by repetition stops being a viable approach at all, and the server capacity previously spent handling those requests comes back. A quiet site that feels inexplicably slow is sometimes exactly this.
2. Moving the login URL — know exactly what it buys
Many security plugins offer to move your login page to a different path. It is better to be honest about this one: it is not a fundamental defence. Changing an address does not make an account any stronger.
Its usefulness is of a different kind. Automated requests only knock on the standard path, so moving it makes that noise largely disappear. Server load drops, your logs become readable, and a genuine anomaly is no longer buried under thousands of routine failures. Treat it as an observability improvement rather than a security control and you will use it correctly.
One caveat: forget the new address and you are the one locked out. Save it in your password manager alongside the credentials.
3. Do not lock yourself out
Everything in this part increases the chance of locking yourself out in proportion to how tightly you set it. That happens often enough to prepare for.
The last line deserves emphasis. Knowing in advance how to clear a lockout — the cooldown period, or how to temporarily disable the plugin at file level — turns that situation from an incident into an inconvenience.
One security plugin, not two
To restate the rule from an earlier part: never run two plugins that do the same job. Two security plugins with firewall features will block each other’s traffic and duplicate logs, making cause-finding impossible when something goes wrong. Choosing one and understanding its settings always beats stacking two.
More on logins and access control lives in the security archive, and if you need request limiting applied at the server layer, that is part of the hardening work in our optimization program.
Next part
The final part. Incidents happen even to prepared sites — so here is what to do, and what not to do, in the first hour after you find one.