In shortThe WordPress login page (wp-login.php and wp-admin) is the most attacked page on your site, because every site uses the same address. Protect it with an unexpected username, a strong password, two-factor authentication, a custom login URL, and if possible, restrict wp-admin to your office IP address.
Why the login page? #
Every WordPress site has its login at the same address: /wp-login.php. So attack software tries it on millions of sites automatically, without knowing who you are. Whoever gets into your dashboard controls the whole site.
7 steps to protect your dashboard #
- An unexpected username: Do not use admin or your site name. Create a new administrator with a different name, then delete the old account and assign its posts to the new one.
- A strong, unique password: Read how to create a strong password.
- Two-factor authentication: With a trusted plugin, so login asks for a code from your phone.
- Limit login attempts: Your security plugin locks login after several failures, and our servers do this too. Read brute force protection.
- Change the login URL: A plugin such as WPS Hide Login moves it to something like /my-login, so most automated attempts disappear.
- Restrict wp-admin by IP: If your office has a fixed IP address, allow access from it only (example below).
- Disable xmlrpc.php if you do not need it: It is another way in. Read WordPress xmlrpc.php.
Example: a .htaccess file inside the wp-admin folder that allows only your address, while keeping admin-ajax.php open because the site needs it:
<RequireAny> Require ip 203.0.113.10 </RequireAny> <Files admin-ajax.php> Require all granted </Files>
Careful: replace the example with your real address. If your address changes (like most home and mobile connections), do not use this method, or you may lock yourself out. Keep a copy so you can delete the file from cPanel if that happens.
Habits that protect your dashboard #
- Log out when using a device that is not yours.
- Give each user only the role they need: editor or author instead of administrator.
- Review administrator accounts every month and remove anyone who no longer needs access.
- Always run the site on https. Read SSL certificates.
How Hyyat Host protects your site #
- cPHulk and CSF block addresses that repeat failed logins on wp-login.php.
- If you are blocked by mistake, a CAPTCHA lets you unblock yourself.
- You can also password-protect a folder from cPanel. Read protecting a folder with a password.
Learn more about Hyyat Host WordPress hosting.
Frequently asked questions #
Is changing the login URL enough on its own?
No. It reduces automated attempts, but it does not replace a strong password and two-factor authentication.
I forgot my new login URL. What now?
Disable the login URL plugin by renaming its folder in the File Manager, and wp-login.php comes back.
I locked myself out of wp-admin after restricting the IP. What now?
Delete the .htaccess file in the wp-admin folder from the cPanel File Manager, or open a ticket and we will help.
