How to tighten WordPress login security

The Weak Link

When it comes to the security of your WordPress website, the weakest link is often during login.  When you consider that logging into the dashboard of your WordPress website requires only two things, it becomes critical that access to your website is as secure as possible.  WordPress websites face ever-increasing exploitation attempts due to their use on over 40% of websites worldwide, give or take.  Website attackers will always try the easiest method to gain unauthorized access to a website: its login portal.

Website Attackers and Hackers

We call those who attempt to gain access to your website for malicious reasons “Attackers” and “Hackers“.

• Attackers are those who attempt to gain unauthorized access to a website with the intent to damage or take it down.   You see this often on larger corporate sites that handle complex communication tasks, transportation coordination, utility services, large corporate databases containing personal and valuable information, and so on.  Their goal is to disrupt a website’s functionality to bring it down or cripple it.  The other goal can be to harvest personal information stored in databases.  If you have ever experienced spam phone calls and emails, it is likely that your information has been leaked in a data breach by a website attacker.
• Hackers aim to exploit high-domain-authority websites with significant traffic.  They will often gain access to a site and inject malicious code into either the website’s file system, database, or both.  These “hacks” often redirect visitors from the attacked site to other sites that display content such as pornography, gambling, or high-risk sales.  The effect this has directly impacts the website owner’s reputation, their business, and their bottom line.

WordPress Login Security – the Username

WordPress requires a username and password to log in to the website’s dashboard.  When setting up a user with website access, regardless of the role assigned, the username and password should be as secure as possible.

The username is the first part.  It is important to select a username that is not common or frequently used for convenience’s sake.

Examples of common usernames are: Admin, WPAdmin, Manager, Owner, the website’s actual address, etc.  Variations of these common usernames are frequently attempted.

Hackers and attackers will first attempt to gain access to websites with weak login credentials.  Below are some examples of what this looks like.  We routinely monitor the security of client websites.  We receive multiple reports of malicious login attempts weekly.

A user with IP address 5.68.183.254 has been locked out from signing in or using the password recovery form for the following reason: Used an invalid username ‘admin’ to try to sign in.

The duration of the lockout is 2 months.

User IP: 5.68.183.254

User hostname: 0544b7fe.skybroadband.com

User location: Lambeth, United Kingdom

Another example:

A user with IP address 86.169.72.152 has been locked out from signing in or using the password recovery form for the following reason: Used an invalid username ‘wpadminerlzp‘ to try to sign in.

The duration of the lockout is 2 months.

User IP: 86.169.72.152

User hostname: host86-169-72-152.range86-169.btcentralplus.com

User location: Bury, United Kingdom

These are just a couple of examples of actual attempts by unauthorized users to gain access to websites.

When choosing a username for login credentials, choose one that isn’t common and doesn’t resemble any publicly displayed information on the site, such as emails, phone numbers, or names.

WordPress Login Security – the Password

Fortunately, WordPress does a pretty decent job of helping select a secure password.

As you can see, WordPress will, by default, assign a secure password. These passwords are “obfuscated”, meaning they don’t make any sense at all.   The drawback of course, is its a password not easily remembered.  When creating passwords like this, you need to store them in a secure place for reference.  For security sake, it is important to avoid side-stepping the use of a secure password for something that, while easily remembered, may be common enough for attackers to guess.  

There are many steps you can take to make your website as secure as possible. A good first step is strengthening the weak link – your login credentials.  Lets all do our job, making hackers’ lives more difficult and our websites more secure!