Stop Brute Force Attacks: The One Plugin Setting Most Site Owners Miss

You installed a security plugin. You changed your password. You feel pretty good about your WordPress site’s safety. But automated scripts don’t care about your good intentions. They run around the clock, testing thousands of username and password combinations against your login page. Most site owners set up a security plugin, activate a firewall, and call it a day. That leaves one critical setting untouched. It is the difference between a locked door and a door that looks locked but has a weak latch.

Why Bots Keep Knocking on Your Door

Brute force attacks are not personal. A script scans the internet for any WordPress site using the default wp-login.php path. When it finds one, it starts guessing. It tries “admin” with “password123.” It tries “administrator” with “123456.” It cycles through lists of common credentials stolen from past data breaches.

Your security plugin might block an IP after five failed attempts. But the bot rotates through thousands of different IP addresses. It only needs one lucky guess. If your username is something predictable like “admin” or “[email protected],” the odds shift in the attacker’s favor.

The fix is not complicated. You just need to hide the front door.

The Single Setting That Stops Most Attacks

Here is the setting most site owners miss: change your login page URL. Most security plugins call this “Hide Login Page,” “Login Page URL,” or “Custom Login URL.” It does exactly what it sounds like. It moves your login form away from the default /wp-login.php address to a custom path that only you know.

When you change this URL, automated bots keep hitting the old default page. They find nothing there. No login form. No error messages. Just a 404 page or a redirect. The attack stops because the bot cannot find the door.

How to find this setting in your plugin

Different plugins place this option in different menus. Here is where to look:

1. Open your WordPress admin dashboard.
2. Go to your security plugin’s settings area.
3. Look for a section named “Login Security,” “Brute Force,” or “Advanced.”
4. Find the option labeled “Hide Login Page,” “Custom Login URL,” or “Rename Login Page.”
5. Enter a new path. Use something memorable but not obvious. Avoid things like /login, /admin, or /secure.
6. Save your changes. The plugin will give you your new login URL. Bookmark it.

If you cannot find this setting in your current plugin, you might need a plugin that includes this feature. Many free security plugins offer it. You can also use a dedicated plugin just for hiding the login page.

A Quick Checklist to Lock Down Your Login

Use this list to verify your login page is as secure as possible before you walk away.

• Change the default login URL away from /wp-login.php.
• Enable login attempt limits. Block an IP after 3 to 5 failed tries.
• Turn on two-factor authentication for all admin accounts.
• Remove the “admin” username. Create a new user with a different name and grant it admin rights, then delete the old admin account.
• Disable XML-RPC if you do not need it. This stops brute force attacks that target the /xmlrpc.php endpoint.
• Use a strong, unique password generated by a password manager.

Common Mistakes That Undo Your Hard Work

Even after you set up a custom login URL, a few simple errors can leave you exposed. Avoid these:

Mistake	Why It Hurts	The Fix
Using an obvious custom path	Bots guess paths like /login or /secure	Pick a random string like /mY-s3cur3-p4th
Not bookmarking the new URL	You get locked out of your own site	Save it in your password manager
Keeping the old admin user	Attackers already know that username	Create a new admin user, delete the old one
Forgetting to update bookmarks	Your team cannot log in	Send everyone the new URL
Leaving XML-RPC enabled	Bots bypass your custom login URL	Disable it in settings or via a plugin

“A custom login URL is not a silver bullet. It is the first layer of a defense that also requires strong passwords, two-factor authentication, and regular plugin updates. But it is the layer that stops the vast majority of automated attacks before they even start.”

Step-by-Step: Locking Down Your Login in Under 10 Minutes

Let us walk through the full process with a real example. These steps assume you have a security plugin like Wordfence, All-In-One Security, or Solid Security installed.

1. Open your security plugin settings. Go to your WordPress dashboard and find your plugin under the Settings menu or a dedicated sidebar tab.
2. Navigate to login security. Look for sections named “Login Security,” “Brute Force Protection,” or “Login Lockdown.”
3. Enable custom login URL. Toggle the setting on. Enter your new path. Use something like /secure-area-9821. Avoid anything that includes “login,” “admin,” or “wp.”
4. Save and note your new URL. The plugin will display your new login link. Copy it and store it in a safe place, like your password manager.
5. Test the new URL. Open a private browser window and visit your new custom path. You should see your normal login form. Then visit /wp-login.php. You should see a 404 error or a redirect.
6. Set up login attempt limits. While you are in the settings, configure the plugin to block an IP address after 3 to 5 failed login attempts. Set the lockout duration to at least 15 minutes.
7. Enable two-factor authentication. If your plugin supports it, turn on 2FA for all administrator accounts. This adds a second layer of protection even if someone guesses your password.
8. Remove the default admin account. Go to Users > All Users. Create a new user with a different name and assign it the Administrator role. Log in as that new user. Then delete the old “admin” account.
9. Disable XML-RPC if you do not use it. Many security plugins have a toggle for this. If you need XML-RPC for a specific service, consider restricting it to specific IP addresses instead.
10. Test from a different device. Use your phone or another computer to try logging in with your new URL. Then try logging in through the old /wp-login.php to confirm it is blocked.

What If You Get Locked Out?

It happens. You change the login URL, forget to bookmark it, and now you cannot get into your own site. Do not panic.

If you have FTP or cPanel access, you can disable the plugin that hides your login page. Rename the plugin’s folder in /wp-content/plugins/ by adding “-disabled” to the folder name. That deactivates the plugin and restores your default login URL. Log in, fix your settings, and reactivate the plugin.

If you do not have FTP access, contact your web host. Most hosts can disable a plugin for you through their support panel. Once you are back in, save your new login URL in your password manager this time.

Building a Complete Security Routine

Changing your login URL is a powerful step, but it works best as part of a larger habit. Pair it with a regular review of your site’s users and plugins. If you want to go deeper, check out our guide on the Complete WordPress Hardening Checklist for 15 settings you should configure today. For a broader look at keeping your site safe, read our comparison of WordPress Security Plugins Compared to see which tool fits your needs.

One Change That Rewards You Immediately

Most site owners spend hours tweaking their theme, writing content, and optimizing images. They spend five minutes on security and hope it is enough. That five minutes is usually spent installing a plugin and trusting the defaults.

The one setting that stops brute force attacks is hiding your login page. It takes less than two minutes to configure. It costs nothing. And it immediately stops every automated bot scanning for the default wp-login.php path.

Go open your security plugin settings right now. Find the option to change your login URL. Pick a path that only you would know. Save it. Bookmark it. Then sleep better knowing that the front door to your WordPress site is no longer visible to the entire internet.