Stop brute-force login attacks first by limiting failed login attempts, using strong account rules, and watching your logs from day one. A new WordPress business site is not “too small” to be attacked. WordPress powers about 43% of websites, which makes it a huge target for bots hunting weak passwords [source: W3Techs].
TLDR: Install Login LockDown, set strict lockouts, and remove easy targets like “admin” usernames and weak passwords. For example, if a bot tries 120 password guesses in one minute, a rule allowing only 3 failed attempts can stop 97% of that burst before it gets annoying. A small shop site with 2 staff users may see 50 to 500 fake login attempts a week, even before it ranks in Google. Add alerts and review failed logins weekly so you catch patterns early.
Why brute-force attacks hit new sites so quickly
Bots scan the web all day. They do not care if your website is new, ugly, private, or barely finished. They look for /wp-login.php, try common usernames, then fire password lists at the login form.
It drives me crazy that many business owners only notice this when the site slows down or the hosting company sends a warning. By then, the server may have wasted hours handling junk login requests.
A brute-force attack can cause three problems:
- Account takeover: A bot gets into WordPress and changes pages, users, or settings.
- Server strain: Thousands of login hits can slow a small hosting plan.
- Reputation damage: A hacked site can send spam or show malware warnings.
Use Login LockDown as your first wall
For this topic, the key tool is Login LockDown. It limits repeated failed login attempts from the same IP range. That sounds simple, because it is. Simple is good here.
You can also visit WP Login Lockdown for the dedicated site and extra details. The goal is clear: let real users log in, but slow down bots until they give up.
Good starter settings for a new business website:
- Allowed retries: 3 failed attempts.
- Retry window: 5 to 10 minutes.
- Lockout length: 30 to 60 minutes.
- Longer block: 24 hours after repeated lockouts.
- Log failed attempts: Keep records so you can spot abuse.
Honestly, it feels like overkill until you see the logs. Then you notice the same bot trying “admin,” “manager,” “sales,” and your domain name as usernames. That is when lockouts stop being optional.
Remove the easiest targets
Lockouts help, but they are not magic. You also need to make the login page less rewarding for bots.
- Do not use “admin.” Create a new administrator with a unique username, then delete or demote the old one.
- Use long passwords. Aim for 16 characters or more. Random is best.
- Give staff the right role. Not everyone needs administrator access.
- Delete unused users. Old accounts are silent risks.
- Hide clues. Avoid public author pages that expose usernames if your theme shows them.
Set up alerts before trouble starts
A new business site needs boring security. Boring means you get alerts before panic mode starts. Check failed login logs at least once a week. If you see many attempts from one country, one IP range, or one username, tighten the rules.
Watch for these signs:
- Repeated lockouts against one account.
- Login attempts at odd hours when no staff are working.
- Many username guesses in a short time.
- Sudden hosting CPU spikes tied to login requests.
Expect to waste time on false alarms at first. Some bots are noisy, then vanish. Others come back every night. The point is to learn what normal looks like for your site.
Protect the rest of WordPress too
Brute-force defense works better when the basics are handled. Keep WordPress, your theme, and plugins updated. Remove anything you do not use. Old code gives attackers more doors to test.
Use HTTPS on every page, not just checkout or contact forms. Ask your host for daily backups. Store backups off the server if possible. If the worst happens, a clean restore can save the day.
If you do not use XML-RPC, consider disabling it at the server level or through safe site settings. Some attackers use it to send repeated login attempts without hitting the normal login screen. Test after changing it, especially if you use remote publishing or mobile apps.
A simple launch checklist
- Install and configure Login LockDown.
- Use 3 retries, then lock the source for at least 30 minutes.
- Replace “admin” with a unique username.
- Force long passwords for every user.
- Remove unused accounts and old plugins.
- Review failed login logs every week.
- Keep reliable backups ready.
The best time to block brute-force attacks is before the first real customer visits. Set the rules now, while the site is fresh. You will avoid slowdowns, cleanup bills, and that awful moment when a bot guesses the one password someone reused.
