I don't know how brute force attacks work. I have protected the wp-admin folder with a password, in addition to having the regular Wordpress login. How does having this "second layer" inhibit brute force attacks? Is it because an automated process isn't able to re-launch for the second login?


1 Answer 1


Protecting only wp-admin won't help a lot, at least it won't protect your from brute-force attacks.

A brute force attack is a trial-and-error method used to obtain information such as a user password or personal identification number (PIN). In a brute force attack, automated software is used to generate a large number of consecutive guesses as to the value of the desired data.

So in other words - attacker tries to guess the password by trying to log in with different credentials.

Why protecting wp-admin won't protect you? Because brute-force attacks are not directed at wp-admin. There are two methods used to perform brute-force attacks on WordPress:

  1. Send credentials to wp-login.php and check the response.
  2. Send some authenticated request to xmlrpc.php and check if authentication error occured.

So if you want to protect yourself from brute-force attacks, you should protect these 2 files. This way attacker won't be able to guess the credentials.

Of course protecting wp-admin is also a good idea - this way even if someone breaks the password, he still won't get to wp-admin area.

Although you have to remember that second layer (Basic Auth?) is just one of methods you can use to protect yourself from brute-force. You can also implement login throttling or temporary lockout.

  • Thanks for the excellent response Krzysiek. Login throttling seems like a great solution and one that I've used a plugin for. A couple more questions. 1. Why are there no automated attacks against mywebsite.com/wp-admin.php? 2. Are automated attacks only set up to go through a single layer of login id and password? So, would an attacker be blocked at all if there was a second layer setup, for example from the host I use, on xmlrpc.php or wp-login.php?
    – B McMinn
    Jun 24, 2018 at 2:17
  • @nemomcnobody most of the attacks are automated - it’s a lot easier and faster. And most of the attacks are not pointed on any precise site - they’re just trying to attack sites using WP (because of it’s so popular). So yes - anything that will make your site a little bit different than others will be OK. Just be careful not to harm yourself (for example renaming wp-login.php will make your site different, but also will change brute-force attacks into DDoS attacks) Jun 24, 2018 at 7:19
  • 1
    Sorry, I meant why aren't there automated attacks against .../wp-admin.php like there are for .../wp-login.php? That's what I really don't understand. I've seen lots of blog posts about obscuring wp-login but not wp-admin. I'm in Hawaii and can see the glow of the lava from my porch. Crazy.
    – B McMinn
    Jun 25, 2018 at 19:27
  • @nemomcnobody because if you’re not logged in, then WP-admin will just redirect you to WP-login.php... Jun 25, 2018 at 19:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.