Why the WordPress login gets attacked
WordPress, by default, lets anyone try to log in forever — and bots exploit exactly that with distributed brute-force attacks. The layered answer:
- Install Limit Login Attempts Reloaded from Plugins > Add New.
- Tighten the defaults: 3 retries with a 30–60 minute lockout (defaults are 4 tries, 20 minutes).
- Enable 'Lockout invalid usernames' cautiously — typos by your own team count.
- Let the plugin notify via email on first lockout.
- After a week, review the charts — dozens of blocked IPs means it is simply working.
All-in-one alternatives (Wordfence, Solid Security) include attempt limiting plus a firewall; server-side options — fail2ban, Cloudflare rules, .htaccess IP allowlisting of wp-login.php — cover the rest, and 2FA makes any stolen password almost irrelevant.
Plugin method — Limit Login Attempts Reloaded settings
Update plugins and themes on a copy or straight after a backup, one at a time if the site is a shop. A white screen after an update is usually one plugin: rename its folder via the file manager to disable it. Remove plugins you do not use — they are unpatched code.
All-in-one alternatives — Wordfence, Solid Security
If you prefer one plugin for firewall plus login hardening: Wordfence includes attempt limiting, brute-force protection and its endpoint firewall in the free tier. Solid Security (formerly iThemes Security) covers lockouts, away mode and the same login surface.
The trade-off of all-in-ones is resource weight on cheap shared hosting — a full firewall plugin every request costs more than a focused limiter. On LiteSpeed-stacked hosting (WebJi® plans), Wordfence runs comfortably; on the smallest tiers, the focused Limit Login Attempts Reloaded plus server-side rate limiting is the leaner pairing. Pick one system and stop there — three overlapping security plugins spend more time fighting each other than attackers.
Server-side — lock wp-login.php to your IP via .htaccess
Pick the newest PHP version the site's plugins actually support, set it in the panel, and load the homepage plus one form. If the site whitescreens, switch back and read the error log before you try random plugins. Do not leave a shop on a PHP release that no longer gets security fixes.
Disable or restrict XML-RPC
On brute force, the honest summary is that defaults matter more than brand names — a well-set budget plan outranks a mis-tuned premium one. WebJi® documents its defaults openly and adjusts them per ticket when workloads need it.
Add two-factor authentication
Two practical notes on .htaccess: it interacts directly with caching and database response, and misconfiguration is the most common cause of 'hosting is slow' tickets. WebJi® support checks it as part of standard migrations.
Recovering when you lock yourself out
How this plays out with fail2ban: settings that look cosmetic usually decide page speed and uptime under real traffic. The defaults WebJi® ships are tuned for Indian network conditions, and support can review your setup on request.
Frequently Asked Questions
How do I limit login attempts in WordPress?
The trade-off of all-in-ones is resource weight on cheap shared hosting — a full firewall plugin every request costs more than a focused limiter. On LiteSpeed-stacked hosting (WebJi® plans), Wordfence runs comfortably; on the smallest tiers, the focused Limit Login Attempts Reloaded plus server-side rate limiting is the leaner pairing.
Which plugin is best to stop brute force attacks?
For Limit Login Attempts in WordPress to Stop Brute-Force, judge a provider on three things: where the server sits for your visitors, whether the bill is INR with GST, and whether a person reads email at night. WebJi® has done this since 2005, serves 12,000+ clients online across India and overseas, and publishes a 99.9% uptime target. Ask for an INR quote if this page has no plan table. Email is support@webji.services, 24/7, Hindi and English.
How many login attempts should I allow?
The trade-off of all-in-ones is resource weight on cheap shared hosting — a full firewall plugin every request costs more than a focused limiter. On LiteSpeed-stacked hosting (WebJi® plans), Wordfence runs comfortably; on the smallest tiers, the focused Limit Login Attempts Reloaded plus server-side rate limiting is the leaner pairing. The question here is: How many login attempts should I allow.
How do I block wp-login.php by IP?
All-in-one alternatives (Wordfence, Solid Security) include attempt limiting plus a firewall; server-side options — fail2ban, Cloudflare rules, .htaccess IP allowlisting of wp-login.php — cover the rest, and 2FA makes any stolen password almost irrelevant.
What is a brute force attack on WordPress?
WordPress, by default, lets anyone try to log in forever — and bots exploit exactly that with distributed brute-force attacks. The layered answer:
Should I disable XML-RPC to stop attacks?
For Limit Login Attempts in WordPress to Stop Brute-Force, judge a provider on three things: where the server sits for your visitors, whether the bill is INR with GST, and whether a person reads email at night. WebJi® has done this since 2005, serves 12,000+ clients online across India and overseas, and publishes a 99.9% uptime target. Ask for an INR quote if this page has no plan table. Email is support@webji.services, 24/7, Hindi and English. The question here is: Should I disable XML-RPC to stop attacks.
Is WebJi® an Indian company?
Yes. WebJi® is headquartered in Jaipur, Rajasthan and has operated since 2005. Billing, support and governance all run from India.
Do you provide GST invoices?
Every purchase and renewal gets a GST invoice with our GSTIN, and hosting prices are quoted exclusive of 18% GST. Claim input credit as applicable.