Universally, the WordPress login page sits at the default wp-login.php and wp-admin. Every day, automated scripts test thousands of username and password combinations against WordPress sites. So learning how to protect your WordPress admin login from brute force attacks takes more than one plugin toggle. You need to hide the login page from bots, block weak or reused passwords, and control who can access which account.
This guide covers all three, with real setup steps you can follow today using Ultimate Security, a WordPress security plugin that already has these tools built in.
Table of Contents
Why Your WordPress Admin Login Needs Protection From Brute Force Attacks
A brute force attack works in a simple way. A bot tries username and password combinations against your login form until one works. It does not guess randomly forever. It runs through lists.
WordPress powers a huge share of the web, so its login pages get tested around the clock. Wordfence blocks tens of millions of brute force attempts across its network every day. Cloudflare found that most login attempts on its network come from bots, not real people. A large share of the passwords real users type have already leaked in a data breach somewhere else.
These bots run three common attacks, and all three hit the same login form:
- Classic brute force: the bot guesses random or common passwords against a known username, often “admin.”
- Dictionary attacks: the bot works through long lists of real passwords pulled from past breaches.
- Credential stuffing: the bot reuses email and password pairs stolen from a different website. It bets that the same person reused their login somewhere else.
Attacks in 2026 work smarter than the ones from ten years ago. Bots now run on leaked password databases and AI-generated password guesses built from real breach data. This is why hiding your login URL alone will not stop them. A strong password alone will not stop them either. You need both, plus a way to control who can access each account.
Ultimate Security handles all three from one plugin, so you do not need to piece together several plugins to cover the gaps. The steps below walk through each setting.
Hide Your WordPress Login Page From Bots
Bots do not search for your login page. They already know the address, because every WordPress site uses the same default URL. The fastest way to cut brute force traffic is to move your login page somewhere a bot cannot guess.
How to Set a Custom Login URL
In Ultimate Security, open the Login Hardening section and find the Login Page URL field.
This field shows your current login address. Type in a new one to create a private login page only you know. Once you save it, most bots lose access right away, since they are built to hit the same known address across thousands of sites, not to search for a hidden one.
Redirect or Block the Old Login Page
After you set a new login URL, decide what happens to the old one. By default, the plugin sends visitors to a “page not found” error when they try the old address.
You can also enter a custom URL and redirect them somewhere else instead, such as your homepage. Either option removes the old address as a working entry point.
Add a Consent Message
While you are in this section, turn on the consent message toggle. This adds a short message to your new login page.
It will not stop a bot, but it takes seconds to set up and gives real users a clear sign they are on the right page. You can edit the default text to anything you want.
Cloudflare Protection on Top of Your New Admin Login URL
By changing your login URL inside WordPress, you stop bots that never look past the default address. Connect Cloudflare, and you get a strongest protection that stops traffic before it ever reaches your server.
Ultimate Security includes a Cloudflare WAF rule for wp-login.php. Turn it on, and Cloudflare challenges anyone who hits that default address directly. This is one of the highest-value rules you can run, since wp-login.php is the exact address every scanning bot already knows. Blocked traffic never reaches WordPress at all, so your server never wastes resources on requests that were never going to succeed.
Once you set your own custom login URL, add that same address to the Custom Login URL rule inside Cloudflare too. This closes a gap that renaming alone leaves open. If a bot ever finds your new address some other way, Cloudflare still challenges traffic hitting that custom URL, not just the default one.
Connecting Cloudflare to Ultimate Security is a short one-time setup. If you would rather watch it than read through it, the plugin walks through the same steps in a short setup video, which covers connecting your zone and deploying rules from start to finish.
How to Set Up Login Gate for a Second Login Checkpoint
A custom login URL blocks bots that only scan default addresses. A more determined attacker, or someone who finds your new URL another way, still has to get past your real WordPress login form. Login Gate adds a browser-level checkpoint in front of that form. Visitors need a separate username and password before WordPress even loads the login screen.
How to Create Your Login Gate Credentials
Click the Set Credentials button and choose a username and password just for this checkpoint. The plugin stores these credentials using bcrypt encryption, so nobody, including you, can recover them if you lose them.
Write them down somewhere safe before you turn the feature on. Login Gate also needs HTTPS on your site, since these credentials travel with every request you send. So you must have SSL on your site.
Protect wp-admin and Your Login Page
Turn on the protection toggle, and the plugin automatically covers the two areas attackers target most: the /wp-admin/ folder and your login file. You can toggle each area on separately. A green badge appears next to each one once it is active, so you can confirm coverage at a glance. You can also set a realm name, which is the short message people see in the browser popup that asks for their credentials.
Set Lockout Limits and Trusted IPs
Decide how many wrong password attempts Login Gate allows before it locks someone out, such as 10 attempts. Then set how long that lockout lasts, such as 15 minutes.
If you work from a fixed office or home IP address, add it to the trusted IP list. Login Gate then skips the extra password prompt for you, while every other visitor still has to pass the checkpoint.
Save Your Emergency Access URL First
Before you turn on Login Gate or a custom login URL, generate your Emergency Access link. Click Generate Key, then copy the link and save it somewhere outside your WordPress dashboard.
This link works as your way back in if you ever lock yourself out by mistake. Once you are locked out, you cannot log in to retrieve it, so save it now, before you make any changes.
Stop Weak and Reused Passwords From Being the Way In
After hiding your login page, you stop bots that rely on finding it. It does nothing if someone already holds a working password, whether they guessed it or bought it from a past breach. This is where password rules take over.
How Do You Turn On Password Requirement Policies and Choose a Preset
Find the password policy settings and switch on Enable Password Policies. This master switch controls every rule below it. Then pick one of the three presets: Basic, Strong, or Enterprise. Each preset fills in matching settings for length and character rules automatically, so you get a solid starting point in one click instead of guessing at numbers yourself.
Set Your Own Password Rules
If the presets do not match what you need, adjust the details by hand:
- Minimum length sets how many characters a password must have.
- Require uppercase and lowercase blocks passwords that use only one case.
- Require numbers forces at least one digit in every password.
- Require special characters forces at least one symbol, like ! or #.
- Exclude characters lets you ban specific symbols that cause problems on your site.
Stop Reused and Expired Passwords
Password history stops someone from reusing a recent password when they update it. So a user cannot reuse their most recent password. You can raise this number so users cannot reuse their last several passwords.
Expiration period forces users to pick a new password after a set time. Set it to 0 and passwords never expire. Enter a number and choose months or years, and the plugin enforces a change on that schedule.
Warning days notify users ahead of time so the change does not surprise them.
The grace period gives users a few extra days to log in and set a new password after their old one expires, before they get locked out completely.
Turn on email notifications so users get these reminders automatically, without you tracking anyone down.
How to Block Passwords Hackers Already Have
This next part matters more than almost anything else on this list. Even a long, complex password can still be dangerous if it already leaked in a past breach. Turn on Refuse Compromised Passwords, and the plugin checks every password attempt against the Have I Been Pwned database in real time. This runs during registration, profile updates, and password resets.
If a password shows up in that database, the plugin blocks it instantly. The user sees a warning box that states exactly how many times their chosen password has appeared in known data leaks. This single setting blocks the exact kind of password that credential stuffing bots are built to exploit. A full password policy for your WordPress users should always include this kind of breach check, not just length and character rules.
Force a Password Reset for Every User
If you suspect a breach, or you are simply tightening security after reading this guide, save your password policy settings first. Then click Force Password Reset For All Non-Admin Users. This action revokes active sessions across your site right away, so a confirmation window appears.
Type FORCE into the text box to confirm, then click Force Password Reset to run it. Administrator accounts stay excluded, and you cannot undo the action in bulk once it runs, so use it when you actually need it rather than as routine cleanup.
Control How Users Recover Their Password
Review how your site handles forgotten passwords. You can turn on Disable Self-Service Reset to remove the standard “lost your password” link. Pair this with a custom reset message that tells users to contact you directly, which works well for sites where you want to verify requests personally. You can also add a custom reset URL that sends users to your own support page instead of the default WordPress flow.
Turn on First Login Reset for new accounts, and the plugin forces every new user to set their own password the first time they log in. This way, the person who created the account never knows the final password the user picks.
Manage Accounts Without Weakening Them
One habit quietly undoes good password rules: resetting a user’s password just so an admin can check something on their account. Every reset like that creates a new password that ends up in an email or a chat message.
Admin Password Authentication solves this a different way. Go to the Login Hardening section, open the Admin Password Authentication tab, and switch on Enable Administrator Password Use. Save your changes, and admins can now log into lower-level accounts using their own credentials. They never need to know or reset that user’s password.
Administrator accounts always have this ability, and you cannot turn it off for that role. You choose which other roles it applies to: Editor, Author, Contributor, or Subscriber. Enable only the roles your team actually needs.
Think about how this plays out day to day. A writer forgets how to format a block, or a subscriber says a feature is not working. Without this feature, the usual fix is resetting their password and sending a new one over email or chat, hoping nobody else sees that message. With Admin Password Authentication, an admin logs into that account directly, sees exactly what the user sees, and fixes the problem. No new password gets created, no message gets sent, and the password rules you set up earlier stay untouched.
Frequently Asked Questions
Does hiding the WordPress login page actually stop brute force attacks?
It stops bots that scan the same default address across thousands of sites, which covers most attacks you will see. It will not stop a targeted attacker who finds your new URL another way. This is why you should pair it with Login Gate and strong password rules.
What makes a strong WordPress password policy?
A strong policy combines minimum length, mixed case, numbers, and special characters with real-time compromised password checking. Length and character rules alone are not enough, since a long, complex password can still be one that already leaked in a data breach.
How do I force all WordPress users to reset their password?
Enable and save your password policy first. Then use the force reset option for all non-admin users, and type FORCE to confirm. This revokes active sessions across the site right away.
What if I get locked out after hardening my login?
Generate your Emergency Access URL before you turn on any login changes, and save it somewhere outside your WordPress dashboard. Bookmark your new custom login URL too, since that is the other detail people forget to write down.
Do I need a custom login URL if I already use strong passwords?
Yes, because a strong password does nothing if a bot never reaches your login form in a way you can monitor or limit. A custom login URL removes your site from automated scans, while your password policy protects the login form itself. They cover two separate gaps, not the same one.
What is the difference between Login Gate and a custom login URL?
A custom login URL hides where your login page lives. Login Gate adds a second login prompt in front of that page, so even someone who finds the new URL still needs a separate set of credentials before WordPress loads. One hides the door, the other guards it.
Final Thoughts
A single setting was never going to be enough, and that is the point worth remembering here. A hidden login page stops bots that only know the default address. A password policy with breach checking stops bots that already hold a working password. Admin Password Authentication stops your own team from quietly creating new weak passwords through routine resets. None of these fixes replace each other, they sit next to each other. Set up all three in Ultimate Security today, and the gaps a single setting would have left open finally close.
Comments are moderated. Stay on topic: spam and link drops are removed.