WordPress login security checklist 2026 covers the practical actions every site should take. Each item is small. The combination is what produces real security. This guide is the checklist condensed into one reference.
Change the login URL
Hide /wp-admin and /wp-login.php behind a custom URL. Removes the site from the automated attack queue. First action of the checklist.
Five minutes work. Permanent reduction in attack volume.
Enable brute force lockout
Lockout IPs after five failed attempts within fifteen minutes. Adjust the thresholds based on your team usage patterns. Document the unlock procedure.
Most automated attacks give up after the first lockout.
Enforce 2FA for administrators
Every administrator account needs a second factor. Defyn Security Manager ships TOTP based 2FA with backup codes and per role enforcement. Roll out to administrators first, then editors.
the Defyn Security Manager plugin closes the credential stuffing vector that bypass URL hiding and rate limiting.
Enable audit logging
Log every login attempt. Record IP, username, success or failure, timestamp. Search the log monthly for anomalies. Configure alerts for sudden bursts.
The audit log is also evidence after a suspected breach.
Document recovery procedure
What happens if 2FA device is lost? What happens if the custom URL is forgotten? Write the recovery steps down before they are needed.
Recovery procedure is the difference between a calm afternoon and a panicked weekend.
Frequently asked questions
How long does wordpress login security checklist 2026 take to complete?
An hour for the initial setup. The rest is ongoing review.
Do I need a paid plugin?
No. Free plugins cover every checklist item.
How often should I revisit?
Quarterly review of audit logs and lockout history. Annual review of the whole checklist.
What if my team resists 2FA?
Make it a hiring requirement. Train new staff at onboarding.
Related reading
- Why login security matters
- Brute force anatomy
- Defyn Security Manager on WordPress.org – the plugin powering these techniques.
