Login security, brute-force stops at the door.

Most WordPress sites are not compromised by a sophisticated targeted attack. They are compromised by automated credential guessing against wp-login.php, running continuously, against every WordPress site the crawler can find, using passwords leaked from unrelated breaches years ago.

It works often enough to be worth automating because password reuse is close to universal. The password on your WordPress admin account is very likely the password from a forum account that was breached in 2016, and the attacker does not need to guess it, they need to look it up and try it.

Nothing about this is clever, and that is the point. It is the highest-volume attack against WordPress and it is defeated by three unglamorous controls, all of which arrive at Basic.

Brute-force lockout limits how many attempts an address can make before it is stopped. This is the control that turns an attack requiring seconds into one requiring years, and it works because the economics of automated guessing depend entirely on volume. An attacker who gets five attempts moves on to the next site.

Google reCAPTCHA on the login form filters the automated submissions that never involve a human at all. It is not a complete answer on its own, CAPTCHA-solving services exist and are cheap, but it removes the untargeted background noise, which makes the attempts that remain worth looking at.

Two-factor authentication with TOTP is the one that actually settles the question. With a second factor, a correct password is not sufficient. Every leaked-credential attack, every reused password, every phished login stops being enough on its own. If you enable one thing from this page, enable this.

Security controls that are painful get disabled, usually by the person who complained loudest, usually right before the incident. Lockout thresholds are configurable so a genuinely forgetful administrator does not lock themselves out of their own site on a Friday evening, and IP allow lists let a known office address bypass the noise.

Two-factor rollout is worth staging on a site with several editors: enable it for administrators first, where the risk concentrates, then widen it. An administrator account is the one that can install a plugin, which is to say the one that can execute arbitrary code.

Login security pairs directly with the audit log, which arrives at the same tier. Lockout tells you an attack is happening; the audit log tells you afterwards whether any of it worked, which account was used, and what it touched once it was in.