Security and Backups

How to Protect Access to Your WordPress Site

Updated 2 months ago

Brute-force attacks on WordPress are becoming increasingly common. The truth is that attackers can find lists of vulnerable sites with a few simple Google searches, then systematically try different passwords until they find the right one.

That’s why securing access to your WordPress site is essential. Here are some suggestions:

  1. Change the URL used to log in: By default, the URL for logging in to any WordPress site is midominio/wp-admin or /wp-login.php, making it very easy for an attacker to know where to try to break in. We therefore recommend the WP Hide Login plugin (which is very lightweight). After activating it, set a specific, private URL (one you come up with) to replace the default login address.

  2. The FluentAuth plugin lets you automatically block any user who enters incorrect details more than 4 times, or however many times you choose to configure it for.

  3. You can automatically filter bots with a CAPTCHA such as Cloudflare Turnstile, which is free and lets you protect the login, registration, password reset, and WooCommerce sign-up forms.

Was this helpful?
Was this helpful?