Harden your WordPress login

Step 1: Retire the account named admin

It is the first username every automated attack tries. WordPress cannot rename a user from the dashboard, so create a new administrator with a different username, log in as it, then delete the old account and attribute its content to the new one when asked.

Step 2: Use unique passwords and remove spare administrators

Every administrator needs a long password used nowhere else. Open Users, filter by Administrator, and downgrade anyone who only writes content to Editor or Author. Each administrator account is a full set of keys to the site.

Step 3: Turn on two-factor authentication

Install a two-factor plugin, such as Two Factor or Wordfence Login Security, and enable an authenticator app for every administrator. Save the backup codes it offers somewhere outside the site.

Step 4: Limit failed logins

Out of the box, WordPress allows unlimited password attempts. A plugin such as Limit Login Attempts Reloaded locks an address out after a few failures, which turns a brute-force attack from millions of guesses into a handful.

Step 5: Close XML-RPC if nothing uses it

xmlrpc.php accepts many login attempts in a single request. Jetpack and some mobile and publishing apps depend on it, so check before blocking. If nothing does, deny it in .htaccess.

<Files xmlrpc.php>
  Require all denied
</Files>

Step 6: Disable the built-in file editor

If an administrator account is ever compromised, the theme and plugin editor lets the attacker write PHP straight onto the server. Add this to wp-config.php to remove it.

define( 'DISALLOW_FILE_EDIT', true );