Open any WordPress security log and you will see it: endless failed logins for “admin” from IPs around the world. This is background radiation — automated bots hammering every WordPress site on the internet. You cannot stop them trying. You can make trying useless.
1. Rate-limit login attempts
Out of the box, WordPress allows unlimited guesses. A limit-login plugin (or your host’s built-in protection) that locks an IP after a handful of failures turns a million-guess attack into a five-guess one. Pair it with alerting so repeated lockouts are visible rather than silent.
2. Add two-factor authentication
With 2FA, a correctly guessed password still is not enough. Enforce it for administrators and editors at minimum. An authenticator app is stronger than email codes; hardware keys are stronger still. This single control converts brute force from a real threat into noise.
3. Close the XML-RPC multiplier
The old xmlrpc.php endpoint supports multicall — hundreds of password attempts in a single HTTP request, sailing past naive rate limits. If nothing you run depends on it (the classic mobile app and Jetpack are the usual dependents), block it at the server or with a security plugin.
4. Deny the easy half of the equation
A brute-force attempt needs a valid username and “admin” is the first guess. Do not have a user called admin, and note that author archive URLs leak real usernames — many security plugins can block that enumeration. Every bit of guesswork you force back onto the bot raises its cost.
5. Keep it in perspective
Renamed login URLs, country blocking and CAPTCHAs reduce log noise, and that has value — but they are conveniences, not walls. Rate limiting + 2FA + strong unique passwords is the actual defence. With those three in place, the bots can hammer away forever and it simply does not matter.