If you’re here because you’re getting a flood of failed login notifications, or you noticed a wall of login attempts in a log somewhere, take a breath first. This is almost certainly not what it feels like.
The reassuring part first
Failed login attempts on /wp-login.php, even a lot of them, are overwhelmingly automated bots, not a person specifically targeting your site. Every WordPress site uses the exact same default login path, so bots scan the entire internet, find anything running WordPress, and immediately throw the same list of common username/password combinations at that same standard URL, indiscriminately, across millions of sites at once. It has nothing to do with your site being “found” or singled out. A five-page hobby blog and a busy store see the exact same automated traffic hitting the exact same login path.
Critically: a failed login attempt is, by definition, an attempt that didn’t work. Seeing a lot of them doesn’t mean anyone’s gotten in, it means the door held.
How to tell if it’s just noise, or something worse
Worth checking these specifically before assuming the worst:
- Is there a new administrator account you didn’t create? Check Users → All Users. This is the one that actually matters.
- Has the site slowed down noticeably, or are you seeing unexpected outbound traffic? Can indicate a compromised site being used to attack others, a genuinely different situation from failed login noise.
- Have any core files or plugin files changed unexpectedly? File integrity monitoring (many security plugins include this) will flag this specifically if it’s happened.
If none of those are true, what you’re looking at is standard, constant, background bot noise, unpleasant to watch happening, but not evidence anything has actually succeeded.
What to do right now, in order
1. Confirm every admin password is genuinely strong and unique. If there’s any chance an admin account is using a weak or reused password, change it now, before anything else. This is the single thing that actually matters if the attack ever does get lucky.
2. Turn on two-factor authentication, for every administrator and editor, not just yourself. Once this is on, a correctly guessed password alone stops being enough to get in.
3. Limit login attempts. WordPress has no built-in limit on how many times someone can try to log in, an attacker can throw 10,000 guesses at it and WordPress will process every single one without complaint. A rate limit that temporarily locks out an IP after a handful of failed attempts turns an unlimited automated attack into a slow, impractical one. This is standard in most security plugins and one of the highest-impact things you can turn on today.
Once the immediate stuff is handled
Hide your login URL. Since bots are specifically targeting the default /wp-login.php path blindly, moving it removes your site from that entire blind sweep. It’s not a complete defense on its own, and it’s worth a specific warning: this is the one setting most likely to lock you out if misconfigured, so always test the new URL in a private browser window before logging out of your current session.
Check whether the attempts are actually coming from a wide spread of IPs, or a concentrated few. A handful of source IPs is easier to block outright. A wide, distributed spread (many different IPs, low volume each) is a different, harder-to-block pattern, and worth knowing which one you’re actually facing.
Where a security plugin genuinely helps here
This is close to the textbook use case for a security plugin. SecondGate covers the core response for free: brute-force rate limiting and lockout, and 2FA with passkey support so a correct password guess alone stops mattering. Its Pro tier (£39.99/year) adds a canary trap that catches a different, higher-confidence signal entirely, fake versions of paths (/wp-config.php.bak, /.env) that no legitimate visitor would ever request, automatically deny-listing any IP that hits one, along with composite threat scoring for the harder case above, a distributed attack spread thin across many IPs rather than one obvious source.
