In this article, we will show you five advanced methods to improve WordPress login security and prevent getting hacked.<\/p>\n\n\n\n\n\n\n\n
How to secure a WordPress login page in 2023<\/h2>\n\n\n\n
There is plenty of poor advice in the realm of cyber security. Most of it is aimed at driving people into fear and making them give in to compulsive choices. Instead of adding to the noise, in this article, we’ll show you methods that actually work. Those are:<\/p>\n\n\n\n
- \n
- Change login page URL<\/a><\/li>\n\n\n\n
- Implement two-factor authentication<\/a><\/li>\n\n\n\n
- Limit failed login attempts<\/a><\/li>\n\n\n\n
- Prevent discovery of username<\/a><\/li>\n\n\n\n
- Use auto logout<\/a><\/li>\n<\/ul>\n<\/div>\n\n\n\n
\n\t\t<\/div>\n\t\t\t\n\t\t \t\n\t\t \t\tWant to #secure your #WordPress #login page? Here's what you need to do \ud83d\udd12<\/a>\n\t\t \t<\/div>\n\t\t \t\n\t\t \tClick To Tweet \n\t\t \t\t<\/span>\n\t\t \t<\/a>\n\t\t <\/div>\n\t\t<\/div>\n<\/div>\n<\/div>\n\n\n\nYou must have noticed that we haven’t included enforcement of strong passwords<\/a> and installation of SSL certificates<\/a>. That’s because it’s a given. We hope that you are already using those. See our other guides on how to get that done. <\/p>\n\n\n\n
Note: To carry out the measures we have mentioned below, you will need to install a plugin or two. And we know even the best plugins can cause a breakdown. So do a backup of your website<\/a> before you proceed any further.<\/em><\/p>\n\n\n\n
Now, let’s begin:<\/p>\n\n\n
<\/div>\n\n\n\n1. Change login page URL<\/h2>\n\n\n\n
As we said at the beginning of the article, the default WordPress login page looks like this:<\/p>\n\n\n\n
- \n
www.website.com\/wp-admin\/<\/code><\/li>\n\n\n\nwww.website.com\/wp-login.php\/<\/code><\/li>\n<\/ul>\n\n\n\nEverybody knows it, including hackers who design bots that target WordPress login pages. And since 59% of Americans [1]<\/small> use weak passwords, it’s way too easy to hack a website by brute-forcing the login page<\/em>. <\/p>\n\n\n\n
One way to protect your login page is by changing the URL.<\/p>\n\n\n\n
Creating a new custom login page URL is easy. There’s a number of plugins available that let you do that in a couple of clicks.<\/p>\n\n\n\n
We will use the WPS Hide Login<\/a> plugin to demonstrate the process, but if you prefer any of the other plugins, go right ahead. The steps will be equally easy and swift.<\/p>\n\n\n
<\/div>\n\n\n\nHow to change your WordPress login URL<\/h3>\n\n\n\n
Install and activate WPS Hide Login.<\/em> Go to Setting \u2192 WPS Hide Login<\/strong>. <\/p>\n\n\n\n
Scroll down at the bottom of the page, insert the new URL in the Login URL<\/strong> section, and hit Save Changes<\/strong>. <\/p>\n\n\n
\n![\"wps](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2021\/10\/wps-hide-login-settings.png\")
<\/figure><\/div>\n\n\nTry logging in with the new URL. Don’t forget to share it with your teammates. <\/p>\n\n\n\n
\ud83d\udc49 If you need assistance, here’s our dedicated guide: how to change your WordPress login page URL<\/a>.<\/p>\n\n\n
<\/div>\n\n\n\n2. Implement two-factor authentication<\/h2>\n\n\n\n
You must have come across two-factor authentication while using Facebook and Gmail. The services typically send a unique code to your registered mobile number whenever you try to log into your account. This security measure is implemented to make sure only the owner of the account can access it. Even if hackers could get their hands on your credentials, there is no way they can steal the unique code sent to your registered mobile number. <\/p>\n\n\n\n
Two-factor authentication can also be applied to your WordPress website. It’ll add a layer of security to the login page. All you need to do is to install any of the following plugins:<\/p>\n\n\n\n
- \n
- miniOrange’s Google Authenticator<\/a> <\/li>\n\n\n\n
- Google Authenticator \u2013 Two Factor Authentication (2FA)<\/a><\/li>\n\n\n\n
- WP 2FA by WP White Security<\/a><\/li>\n<\/ul>\n\n\n\n
Setting up a two-factor authentication plugin is very easy. We’ll use miniOrange’s Google Authenticator to show you the setup process. <\/p>\n\n\n
<\/div>\n\n\n\nHow to implement two-factor authentication<\/h3>\n\n\n\n
Install the miniOrange’s Google Authenticator on your WordPress login page. As soon as you activate the plugin, a setup widget appears. Choose the first option, i.e. Google Authenticator<\/strong>. <\/p>\n\n\n
\n![\"miniorange](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2021\/10\/miniorange-setting-up.png\")
<\/figure><\/div>\n\n\nNext, download the Google Authenticator app on your smartphone. Open the app and scan the QR code<\/strong>. <\/p>\n\n\n
\n![\"2fa](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2021\/10\/2fa-google-authenticator.png\")
<\/figure><\/div>\n\n\nThe app generates a code<\/strong>. Enter it on the setup widget and hit Save<\/strong>. <\/p>\n\n\n\n
2FA WordPress login security is now active on your login page.<\/p>\n\n\n
\n![\"WordPress](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2021\/10\/miniorange-2fa-on-wordpress.png\")
<\/figure><\/div>\n\n<\/div>\n\n\n\n3. Limit failed login attempts <\/h2>\n\n\n\n
WordPress allows its users unlimited login attempts. This may sound harmless, but to be honest, it’s a glaring security loophole. <\/p>\n\n\n\n
Unlimited login attempts enable hackers to carry out brute force attacks. In this type of attack, hackers deploy bots to find the right combination of username and password. The bots fail several times before chancing upon the right credentials. One of the most effective ways to counter bot attacks is to limit login attempts. <\/p>\n\n\n\n
The plugins below will help you do just that: <\/p>\n\n\n\n
- \n
- Limit Login Attempts Reloaded<\/a><\/li>\n\n\n\n
- WPS Limit Login<\/a><\/li>\n\n\n\n
- WP Limit Login Attempts By Arshid<\/a><\/li>\n<\/ul>\n\n\n
<\/div>\n\n\n\nHow to limit failed login attempts<\/h3>\n\n\n\n
Install the plugin and then go to Limit Login Attempts \u2192 Settings \u2192 Local App<\/strong>. Here you can set how many times login attempts should be allowed on your website. And for how long someone will remain locked out after said number of login attempts.<\/p>\n\n\n
\n![\"limit](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2021\/10\/limit-login-attempts-plugin.png\")
<\/figure><\/div>\n\n<\/div>\n\n\n\n4. Prevent discovery of username<\/h2>\n\n\n\n
Typically, username is considered less important than the password. It is a publicly available record, and that is why we assume it must be of low value. Not true. <\/p>\n\n\n\n
The username makes half of your credentials. It must be protected, just like the password. <\/p>\n\n\n\n
On a WordPress website, you will find usernames displayed on posts and author archives. Thankfully, there is a way to disable them both. <\/p>\n\n\n
<\/div>\n\n\n\nHow to disable author archives<\/h3>\n\n\n\n
This can be done with the help of any SEO plugin. In the tutorial below, we are using Yoast SEO to show it. <\/p>\n\n\n\n
Go to SEO \u2192 Search Appearance \u2192 Archives <\/strong>and then disable the Author Archives. Hit Save Changes<\/strong>.<\/p>\n\n\n
\n![\"yoast](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2021\/10\/yoast-author-archive.png\")
<\/figure><\/div>\n\n<\/div>\n\n\n\nHow to change display name<\/h3>\n\n\n\n
The display name shows up on published articles and comments. By default, the display name and the username (the one you use to log in) are the same. To prevent the discovery of the username, you can change the display name to something else.<\/p>\n\n\n
\n![\"username](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2021\/10\/username-and-display-name.png\")
<\/figure><\/div>\n\n\nGo to Users \u2192 Profile \u2192 Nickname<\/strong>. You can’t directly change the display name. Instead, change the Nickname. Then select the new nickname<\/strong> from the drop-down menu below. <\/p>\n\n\n
\n![\"display](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2021\/10\/display-name-drop-down.png\")
<\/figure><\/div>\n\n<\/div>\n\n\n\n5. Auto logout<\/h2>\n\n\n\n
Auto logouts protect websites from snoopers. When users leave sessions unattended, auto-logouts end the session, protecting the website. <\/p>\n\n\n\n
The default WordPress behavior is to log out the user 48 hours after the login session cookie expires. And if the user checked the “Remember Me” box, you will remain logged in for 14 days. To terminate sessions due to a bit of idle time, you need to install a separate plugin. <\/p>\n\n\n\n
The plugins below help you auto-logout to end idle user sessions:<\/p>\n\n\n\n
- \n
- Inactive Logout<\/a><\/li>\n\n\n\n
- iThemes Security<\/a><\/li>\n<\/ul>\n\n\n
<\/div>\n\n\n\nHow to enable auto-logout<\/h3>\n\n\n\n
Activate the plugin and then go to Settings \u2192 Inactive Logout \u2192 Basic Management<\/strong>. Set the clock for an idle timeout. There are options for role-based timeouts as well. Check it out if you like.<\/p>\n\n\n
\n![\"inactive](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2021\/10\/inactive-user-logout-settings.png\")
<\/figure><\/div>\n\nGo to top<\/a><\/div>\n\n\n\nConclusion on WordPress login security<\/h2>\n\n\n\n
\n\nAll set? Great! Before you leave this page, one last piece of advice: Improving WordPress login security takes you a step closer to securing your entire website, which is the end goal! <\/p>\n<\/div>\n\n\n\n
\n\t\t<\/div>\n\t\t\t\n\t\t \t\n\t\t \t\tWant to #secure your #WordPress #login page? Here's what you need to do \ud83d\udd12<\/a>\n\t\t \t<\/div>\n\t\t \t\n\t\t \tClick To Tweet \n\t\t \t\t<\/span>\n\t\t \t<\/a>\n\t\t <\/div>\n\t\t<\/div>\n<\/div>\n<\/div>\n\n\n\nEven though you implemented measures to prevent hackers from brute-forcing into your website, the intruders can still gain access through vulnerable themes and plugins. Therefore, keep your site up to date round the clock. <\/p>\n\n\n\n
To further secure your website, we highly recommend that you take all the security measures covered in this guide: 10 key WordPress security tips<\/a>.<\/p>\n\n\n\n
If you have any questions on how to handle your WordPress login security, let us know in the comments below.<\/em><\/strong><\/p>\n\n\n
- iThemes Security<\/a><\/li>\n<\/ul>\n\n\n
- WPS Limit Login<\/a><\/li>\n\n\n\n
- Google Authenticator \u2013 Two Factor Authentication (2FA)<\/a><\/li>\n\n\n\n
- Implement two-factor authentication<\/a><\/li>\n\n\n\n