It’s not a hacker in a hoodie. It’s a loop.
If you’ve ever glanced at who’s trying to log into your WordPress site, the volume alone tells you something’s off — dozens or hundreds of login attempts a day from places you’ve never heard of, with usernames like “admin” and passwords that look pulled from a list. This isn’t someone sitting at a keyboard, personally interested in your site. It’s an automated script, written once, running against your login page the same way it’s running against millions of others, with no human checking in until something actually works.
Why it never seems to stop
The login URL on a default WordPress install is the same on every single site — /wp-login.php, every time. That predictability is what makes this kind of attack so persistent: a bot built to try common username-and-password combinations against that one path works against every WordPress site on the internet, forever, with zero extra effort required to add your site to the list. It’s not clever. It’s just relentless, running around the clock whether anyone’s watching or not.
What actually stops it
This specific threat — high-volume, automated, not personally targeted — doesn’t require defending against a skilled adversary. The relevant measures are:
- Strong, unique passwords. A password that isn’t on any common list defeats this entire category of attack by itself.
- Two-factor authentication. If a password leaks somewhere else and gets reused here, a second step still blocks the takeover. Setup takes a few minutes per account.
- Rate-limiting on login attempts. Slowing down or temporarily blocking an IP address after repeated failed attempts raises the cost of this kind of script running against your site.
- Moving your login page off the default URL. This doesn’t stop someone specifically targeting your site who already knows where to look — but it removes you from the pool of sites generic, automated scans can reach without effort, and it makes any real, targeted attempt easier to notice in your logs.
The actual takeaway
Most of the traffic hitting your login page is automated and indifferent to who you are, which is why none of the measures above need to be sophisticated to be effective. Turning on two-factor authentication is one of the lower-effort items on this list relative to the risk it closes off.
Loyal Security — Firewall & Malware Scanner
Free on WordPress.org: firewall, malware scanning and login protection in one plugin. Upgrade to Pro for threat intelligence, Sentinel and uptime monitoring.