How to Protect Access to Your WordPress Site
Updated last month
Brute-force attacks on WordPress are becoming increasingly common. The fact is that malicious actors can find lists of vulnerable sites simply by performing basic Google searches, and then systematically try different passwords until they find the right one.
That is why protecting access to your WordPress site is essential, and below we share some suggestions:
Change the URL we use to log in: By default, the URL for logging in to any WordPress site is mydomain/wp-admin or /wp-login.php, making it very easy for an attacker to know where to force entry. For this reason, we recommend the WP Hide Login plugin (which is very lightweight) and, after activating it, setting a specific, private URL (created by us) to replace the default login address.
The FluentAuth plugin allows you to automatically block any user who enters incorrect information more than 4 times, or as many times as we choose to configure it.
We can automatically filter bots with a captcha such as Cloudflare Turnstile, which is free and protects the login, registration, password recovery, and WooCommerce account creation forms.