Hundreds of failed logins on your WordPress site: what matters and what does not

You installed a security plugin, and now it emails you every day to say your site blocked four hundred login attempts. Or you looked at the logs for the first time and found somebody has been trying to get in as “admin” every few seconds since March.

The natural reading is that somebody is targeting your business. It is worth saying plainly, before anything else, that they almost certainly are not.

Why you are seeing hundreds of failed logins

Automated software scans the entire internet continuously looking for WordPress sites, and every WordPress site has its login page in the same place. Having found one, the software tries a list of common usernames and passwords, gives up after a while, and moves on.

This happens to every site. A local plumber, a national charity and a FTSE company all get the same treatment, because the process never looks at who you are. Your security plugin has simply started telling you about weather that was always there.

Failed login attempts are not evidence that you are a target. They are evidence that you have a website. The number worth worrying about is not how many failed, it is whether any succeeded.

That said, this background noise is exactly how sites get broken into, because eventually one of these attempts finds a weak password on a forgotten account. So the right response is neither panic nor ignoring it. It is closing the few things that actually matter.

The two changes that do most of the work

1. Two factor authentication on every administrator

If there is one thing on this page to do this afternoon, it is this.

Two factor means a password alone is not enough. Even if an attacker has your password, from a data breach somewhere else or from guessing, they cannot get in without the code on your phone. It turns the entire category of password guessing into a waste of their time.

Use an authenticator app rather than SMS where you can. SMS is much better than nothing and is also the weakest form, because phone numbers can be moved to a new SIM by someone who knows enough about you.

Apply it to every account with administrator or editor rights, not only your own. One developer from two years ago with a reused password undoes the whole exercise.

2. Fewer administrators

Open Users and filter by Administrator. Most sites we look at have between two and five times as many as they need.

The agency that built the site in 2021. A freelancer who did one job. A plugin support technician who needed access for an afternoon. A staff member who left. Every one of those is a live key to your website held by somebody who is no longer thinking about it.

Anyone who writes content is an Editor or an Author, not an Administrator. Administrator means the ability to install code on your server, and very few people in an organisation need that. Removing an account takes ten seconds and is the single cheapest security improvement available.

Worth doing, in roughly this order

1. Limit login attempts. Lock an IP address out for a while after a handful of failures. Most security plugins do this and most have it switched on by default. It converts an endless guessing attack into a few attempts an hour.
2. Remove the username “admin”. Every automated attack tries it first. You cannot rename a WordPress user, so create a new administrator with a different name, log in as that, and delete the old one, assigning its content to the new account.
3. Use a password manager. The reason people reuse passwords is that remembering unique ones is impossible. A manager removes the reason. This matters more than password complexity rules, because a unique weak password beats a strong reused one.
4. Turn off XML-RPC if you do not use it. An older WordPress feature that allows many login attempts inside a single request, which is convenient for attackers. Some apps and plugins still need it, so check before disabling.
5. Change your login URL. Moving /wp-admin somewhere else removes most of the automated noise, because the bots are looking in the standard place. Treat it as reducing volume rather than as security in itself, and be aware you must remember the new address.
6. Put a firewall in front. A web application firewall blocks a lot of this before it ever reaches your site, which also saves the server resources currently being spent rejecting attempts.

Security theatre worth skipping

Some common advice makes people feel safer without helping much.

• Forcing password changes every ninety days. Widely dropped as guidance, including by the National Cyber Security Centre, because it pushes people towards predictable variations. A long unique password kept until there is a reason to change it is better.
• Hiding your WordPress version number. Trivially discoverable by other means. It costs nothing to do and buys nothing.
• Complexity rules without a manager. Demanding symbols and numbers produces the same word with a nought for an o, written on a note by the monitor. Length and uniqueness beat complexity.
• Relying on the login URL change alone. Useful for noise, but if the address leaks, or a plugin exposes it, you are back to where you started with nothing else in place.

What a successful break-in looks like

Failed attempts are noise. These are the things that mean somebody got in.

• A successful login at an odd hour from a country nobody works in. Most security plugins log this, and it is the single most useful line in the log.
• A new administrator account you did not create. Frequently the first thing an attacker does, so their access survives a password change.
• Your own password stops working. Sometimes they lock you out deliberately.
• Password reset emails you did not request. Somebody is at least trying.
• The administration email address has changed. A quiet way to intercept future resets. Check Settings then General.
• You get logged out repeatedly. Can be innocent, and can also mean security keys were changed or sessions invalidated by someone else.

If you recognise any of those, work through our guide to how to tell if your WordPress site has been hacked before assuming it was a glitch. It happened to us: when our own site was compromised, two administrator accounts had been created that nobody recognised, and that was the clearest single signal.

If you think someone has your password

Changing your password is not enough on its own, and this is the step most people miss.

WordPress keeps you logged in using a cookie signed with a set of security keys stored in wp-config.php. If an attacker has an active session, changing your password does not necessarily end theirs. Replacing those keys does, because it invalidates every existing session on the site including your own.

So the order is: change passwords, replace the security keys in wp-config.php, then check the Users list for accounts you do not recognise, then check whether anything was installed while they were in. A password change alone can leave somebody sitting inside the site with a valid session.

Frequently asked questions

Should I be worried about hundreds of blocked login attempts?

No. Blocked means the system worked. It is normal background traffic for every WordPress site. What deserves attention is a successful login you cannot account for, or a new administrator account.

Why does WordPress keep logging me out?

Usually innocent. Cookie or site address mismatches between the www and non-www versions of your domain, a caching plugin interfering with logged in sessions, or a short session length setting. It can also follow a security key change. If it started suddenly alongside anything else on this page, check the rest before assuming it is a settings problem.

Is changing the login URL actually worth it?

Yes, with realistic expectations. It removes most automated noise and reduces the server load of rejecting it. It is obscurity rather than security, so it should sit on top of two factor and sensible accounts rather than instead of them.

Do I need a security plugin at all?

A good one helps, and it is not sufficient by itself. It cannot decide which of your plugins is risky, update them, test your backups, or notice that a new administrator appeared last Tuesday. Tooling plus a person is the combination that works, which is what our WordPress security services provide.

What about passkeys?

Support is arriving and it is genuinely better, because there is no password to steal or reuse. If your setup supports it and your team can manage the recovery process, it is a good direction. For most small business sites today, two factor on every administrator is the practical answer.

---

Not sure who has access to your site?

Most owners are surprised by their own Users list. We will go through it with you, set up two factor properly, and tell you honestly what else is worth doing and what is not.

Marketing the Change is a digital marketing agency based in Liverpool. We manage WordPress sites for clients across the UK, which means we occasionally find things like this. When we do, we write about it.

\n\n