Your WordPress Login Is the Weakest Door on the Site

Most site takeovers do not start with a clever exploit. They start with /wp-login.php, a reused password, and an inbox nobody checks.

Backups save you after a disaster. Login hygiene stops a large share of disasters from happening. If you skipped the backup checklist last week, start there: Your Site Will Fail the Day You Skip Backups. Then come back and lock the front door.

What actually gets broken

Attackers do not need your theme. They need one of these:

• The default admin username still exists
• The password is reused from another site
• Two-factor authentication is off
• Limit Login Attempts is not installed, so brute force is free
• Five people share one administrator account
• XML-RPC is left open for password spraying

You do not need a security suite with 40 toggles. You need a short list you can finish this morning.

Do this in one sitting

1. Kill the default admin username

Create a new administrator with a name that is not guessable. Log in as that user. Demote or delete admin. Do not rename the old account and hope. Delete it after the new one works.

2. Turn on 2FA for every administrator

Use an authenticator app, not SMS. Apply it to every user who can install plugins or edit settings. If a client refuses 2FA, they do not get administrator. Editor is enough for day-to-day publishing.

3. Stop unlimited login guesses

Install a maintained limit-login plugin. Lock the account after a handful of failures. Email yourself on lockouts so you notice a real attack instead of discovering it in the access log three weeks later.

4. Stop sharing one admin login

One person, one user. When a contractor leaves, you disable their account. You cannot do that if four people type the same password.

5. Change the login path only after the basics

Hiding /wp-login.php is not security. It is noise reduction. Do it after 2FA and lockouts exist. Do not treat a renamed slug as the whole plan.

6. Close XML-RPC if you do not need it

If you are not using the official mobile app or Jetpack features that depend on it, disable XML-RPC. It is a second password door most owners forget exists.

7. Use a password manager

Long, unique, stored. Not a phrase you also use for email. If your host email and site admin share a password, one leak is two doors.

What not to do

• Do not install three overlapping "security" plugins. That is how you get the slow stack problem from this plugin piece.
• Do not hide the login URL and skip 2FA.
• Do not leave old administrator accounts "just in case."
• Do not email passwords in plain text to clients. Send a password-manager invite or sit with them once.

A 15-minute owner checklist

• Default admin user gone
• Unique admin username
• 2FA on every administrator
• Login lockout after failed attempts
• No shared admin accounts
• XML-RPC off if unused
• Host and site passwords are different
• You know who still has administrator

If you cannot tick the last box, that is the real problem. Access lists rot faster than themes.

How this fits the rest of the stack

Login security is not a hosting debate. Whether you are on WordPress.com or self-hosted, the same rule holds: the account that can install plugins is the account that can wreck the site.

It is also not a forms problem. A working contact form is useless if someone else is already inside as admin.

And it is not a reason to buy another course. If you are taking client work, this checklist is part of the first week, same as the first-client work you already shipped.

Official starting points

The project documents hardening steps here: https://automattic.pxf.io/1GKgmg. Use that as the product path if you need hosting or official tools. Then do the list above on the site you already run.

If this saved you an afternoon of cleanup, you can support the writing here: https://ko-fi.com/jstrange.