Securing WordPress: How to Protect Client Websites from Automated Brute-Force Attacks
WordPress powers over 40% of the world's websites, making it the primary target for automated global botnets. In Nepal, dozens of corporate, news, and school websites are breached or defaced every week not because of sophisticated zero-day exploits, but due to unhardened default login endpoints, active XML-RPC protocols, and weak administrator passwords subjected to continuous dictionary attacks.
Strategic Executive Summary
- Core Insight: Automated botnets scan every new domain within 48 hours of DNS propagation. Relying on default WordPress security settings is an invitation to automated credential stuffing.
- Production Quality: Battle-tested engineering techniques designed specifically for Nepal's network infrastructure and business environment.
- Direct Implementation: Copy-paste ready code architectures with security safeguards against race conditions, data corruption, and unauthorized access.
Table of Contents
1. Disabling XML-RPC Immediately
The WordPress XML-RPC API (xmlrpc.php) was originally introduced for remote publishing apps. However, its system.multicall method allows attackers to test hundreds of password combinations in a single HTTP request, completely bypassing basic login rate limiters.
Unless you specifically use the Jetpack mobile application, block XML-RPC at the web server level inside .htaccess:
# Block all external requests to XML-RPC
<Files xmlrpc.php>
Order Allow,Deny
Deny from all
</Files>For Nginx servers, insert this block inside your site configuration:
location = /xmlrpc.php {
deny all;
access_log off;
log_not_found off;
}2. Hardening and Obscuring wp-login.php
Continuous POST requests to wp-login.php deplete PHP worker processes on shared hosting and VPS instances, causing high CPU usage and sluggish site response times.
- Change Default Login URL: Use security plugins (e.g. WPS Hide Login) to map login requests to a private slug like
/safal-portal-auth/. Requests to/wp-login.phpreturn a 404 or redirect to the homepage. - Enforce Two-Factor Authentication (2FA): Require Time-based One-Time Passwords (TOTP) via Google Authenticator or Microsoft Authenticator for all administrator and editor roles.
- Strict IP Whitelisting: If your office or home has a static IP address, restrict WP-Admin access strictly to trusted IPs via
.htaccess:
<Files wp-login.php>
Order Deny,Allow
Deny from all
# Safal Office Static IP
Allow from 103.10.xxx.xxx
</Files>3. Securing wp-config.php and Disabling File Editing
If an attacker gains temporary access to an administrator account, WordPress's built-in theme and plugin file editor allows them to execute arbitrary PHP code directly. Disable this permanently in wp-config.php:
// Prevent backdoors from being written via the WP-Admin editor
define('DISALLOW_FILE_EDIT', true);
// Prevent unauthorized plugin/theme installation from dashboard
define('DISALLOW_FILE_MODS', false); // Set to true on high-security environments
Protect wp-config.php from direct web access by setting its file permissions to 0400 or 0440, and adding this Apache directive:
<Files wp-config.php>
Order Allow,Deny
Deny from all
</Files>4. Cloudflare WAF Custom Rate Limiting Rule
Stop brute-force attacks at the Edge before packets even touch your hosting server. Create a free Cloudflare WAF Rate Limiting rule:
- Rule Criteria:
URI Path contains "/wp-login.php"andRequest Method equals "POST". - Threshold: 5 requests per 10 minutes per IP address.
- Action: Block or Managed Challenge.
Official Technical Documentation & Reference Sources:
