To audit WordPress login security during Cybersecurity Awareness Month, review user accounts, two-factor authentication, login rate limits, and XML-RPC settings. Work through wp-login.php exposure first, then verify each protection actually blocks bad logins. Brute-force attacks mean automated username and password guessing, often spread across a botnet.
WordPress Developer Docs warns these attempts can overwhelm any site exposing wp-login.php, even when logins fail, according to its brute-force security guide. DHS and CISA designated October 2025 as Cybersecurity Awareness Month, according to the DHS announcement. Use that month as your audit deadline.
Table of Contents
- Who can log in right now?
- Is two-factor authentication enforced?
- Do rate limits stop guessing?
- Is XML-RPC still needed?
- Are passwords and updates current?
Who can log in right now?
Start with people, not plugins. Open Users and filter by Administrator role.
WordPress Developer Docs treats a hidden login URL as noise reduction only. Keep real protection in updated core, themes, and plugins.
- Delete unknown administrator accounts.
- Remove or rename the default "admin" account.
- Give each person a unique login and review access logs weekly.
Is two-factor authentication enforced?
WordPress core does not include two-factor authentication. Confirm every administrator uses 2FA through a plugin or identity provider.
CISA directs small businesses to require MFA and pick the strongest available method, according to its MFA guidance for small businesses. It ranks physical security keys as best against phishing, above authenticator apps and SMS codes. Apply keys to administrators first, then to editors.
Do rate limits stop guessing?
WordPress Developer Docs recommends rate limits at the edge or web server. Confirm temporary IP bans and alerts for unusual login activity.
Prefer blocking at the edge through a WAF or CDN. Bad traffic then never reaches your origin server. Test with a few failed logins and confirm the block triggers.
Is XML-RPC still needed?
Check whether your site uses XML-RPC for mobile apps or remote publishing. WordPress Developer Docs advises disabling it when unused.
If you need it, restrict access and rate-limit it. The system.multicall method can pack hundreds of password guesses into one request. That technique can bypass normal login throttling.
Are passwords and updates current?
NIST requires user-chosen passwords of at least 8 characters and systems that accept at least 64 characters, according to the NIST password standard. It also says to change passwords only on compromise evidence, not on a fixed schedule.
Screen existing passwords against known compromised credentials. Keep core, themes, and plugins updated and flag any password reuse for immediate reset.
