Every WordPress website sooner or later becomes the subject of malicious login attempts. If you read a codex, you’ve probably found the brute force attacks article devoted to hacker attacks, and find some key tips on how to protect your website.
Except for this, there are some other widespread ways to protect your website’s admin area, and they include:
- any protecting module or a good security plugin;
- captcha or reCaptcha verification;
- limiting login attempts;
- unique usernames and complicated passwords;
etc.
A good strategy for protecting the login page from the brute force is to hide the login page from hackers. This strategy is good for you only if your site login attempts are limited to admins, authors, editors, and contributors. However, if you run a membership website where it allows user login, hiding the login page is not your variant.
So how to hide your login page from hackers? There are a few steps:
1. Install WordPress in a unique directory
You can install a new WordPress in any subfolder of your server. After that, you can run your WordPress from a subdirectory no matter whether you’re dealing with a new WP installation or an existing website.
Of course, if you are moving the existing WP installation to the subdirectory, you should create a complete backup of your website in advance. Please read the detailed tutorial on how to create a backup here.
When you’re using a unique directory for WordPress, don’t create any predictable and easy-to-guess names for your folder. You can use anything like http://example.com/mycoolwebsite or http://example.com/hellothere or anything else like http://example.com/ghgjgf and this will be tough to predict. Just be sure you will remember the name of the directory or note it down somewhere not to forget.
2. Hide the login page URL and redirect the wp-login.php.
By default, WordPress loads the login page called wp-login.php, but even if you type http://example.com/wp-admin, you will be automatically redirected to a wp-login page.
If your WordPress is already installed in a unique directory (a subdirectory), you’ve added a directory between your domain name and wp-login.php.
However, even if you’ve invented the unique name for your directory, if a hacker tries to go to http://example.com/wp-login.php by typing wp-admin, they will be redirected to the correct login page which will look like http://example.com/ghgjgf/wp-login.php.
To prevent this redirect, you need to lock down access to wp-login.php and redirect it to any page you want or a 404 error page, and then replace it with a fully custom login URL which will also be hard to predict.
Of course, you should create something easy to remember for yourself and hard to guess for others. For instance, this can be something like http://example.com/ghgjgf/hitt or anything else.
We’d also like to present some useful plugins which will help you secure your WordPress login page as well as provide many more great features:
Tartarus Bot Ban & Crawl Control Plugin for WordPress
With the help of this plugin, you can cast out the bad bots that crawl your website. You’ll be able to create a bad crawler trap that will block further access of ‘bad bots’, however, that doesn’t refer to the rules you defined in the robots.txt file.
The solution allows you to automatically block all known bots including the ones with real SEO value – GoogleBot, BingBot, Yandex, etc.
WP Magic Link Login – Passwordless Authentication WordPress Plugin
This solution allows securing your website by allowing your users to log in without a password. After submitting the email address, they’ll receive a secure login link via email that will have an expiration time of 1 to 60 minutes.
When the user accesses the link, it will automatically log in without asking for a password. You can also enhance the security by restricting users to log in from the same IP address that requested the link.
Conclusion:
As you see, it’s easy to protect your WordPress login page either on your own or using any available readymade solutions. Keep staying with us to read more tuts and other exciting things that will help you build and run your WordPress website with simplicity and fun.
