WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been hearing about the recent increase in brute-force WordPress login attempts due to a massive botnet attack. Everything I've read so far indicates that the attack works by just trying different passwords against the "admin" account. If I'm using an alternative login method, such as CAS or some other single sign on provider, is my WordPress installation safe from these attacks, assuming that whatever the SSO provider is doesn't have an easy password on its admin account (if one even exists)?

share|improve this question

If CAS is the only login method, I think your blog should be protected. But, the atackers don't care about alternative login methods. They simply send request against wp-login.php.

So if you still have an account named "admin", CAS cannot protect your blog. Let's think about the worst case. Assuming you have an account named "admin" with the password "1234", but you use always CAS to login but with a different admin account. The attackers still can access your blog through wp-login.php and can get access.

You can try to rename the wp-login.php and test if everything still works. If it so, fine. If not, you have to protect your blog with other additional methods (like login löockdown).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.