You probably do not know exactly who can log in to your website right now. Most owners do not: access builds up over the years through a developer, an agency, a former employee, a friend who helped once. This article covers WordPress login security in practical terms, so you can see who has a way in, close the doors that should be closed, and make the remaining ones much harder to walk through.
8 minute read · Published by WPSiteOps Team
Quick Answer
The strongest WordPress login security comes from four unglamorous changes: turn on two-factor authentication for every account, give each person a unique password used nowhere else, remove accounts for people who no longer need access, and limit how many failed login attempts an address can make. None of it requires code, and all of it can be done in an afternoon. It reduces risk considerably; nothing makes a site impossible to break into.
Most WordPress break-ins are not break-ins
The picture most people have of a hacked website involves someone clever defeating something technical. In practice, a large share of compromised sites are entered the ordinary way: a valid username and a valid password, typed into the normal login screen.
The credentials come from somewhere unremarkable. A password reused on a service that was breached years ago. An old account nobody closed. A login shared by four people, one of whom left in 2023. There is a fuller picture of the other routes in our article on why WordPress websites get hacked, and this piece stays on the access side of it.
That is good news, in a quiet way. Access is the part of website security an owner can actually control without touching a line of code.
Two-factor authentication, in plain terms
Two-factor authentication means that a password alone is not enough to get in. After the password, the site asks for a second thing, usually a six-digit code from an app on your phone that changes every thirty seconds.
The reason it matters more than password complexity is simple. A long, complicated password is still just one thing, and if it is stolen or guessed, it works. A second factor means a stolen password on its own gets nobody anywhere, because whoever has it does not have your phone.
Setting it up on a WordPress site involves adding a reputable authentication plugin, scanning a code with an authenticator app, and saving the backup codes somewhere safe. The whole process takes a few minutes per person. The part that trips people up is not the setup, it is the rollout: everyone who logs in needs it, not just the owner, because a second factor on one account and none on the other four does very little.
Passwords: unique matters more than complicated
The advice everyone has heard is to make passwords complicated. The more useful advice is to make them unique. Reuse is the real problem, because when a password is exposed in a breach somewhere else entirely, automated tools try that same email and password combination across thousands of sites, including yours.
A password that appears in one place and one place only cannot be reused against you, however simple or complicated it looks. That is why a password manager is worth the small amount of effort it takes to adopt. It generates a different password for every site, remembers all of them, and means nobody has to invent or recall anything. Any of the well-established ones will do the job; the choice matters far less than actually using one.
If a password manager is a step too far this month, the minimum worth holding is that your website password is used for your website and nothing else.
The admin user audit almost nobody has done
This is the part most likely to find something today. Open the Users screen in your WordPress dashboard and read the list properly. For each account, ask three questions: do I know who this is, do they still need access, and does the role match what they actually do?
On the sites we take over, there is almost always at least one administrator account nobody present can name. It is usually a developer from a rebuild two or three years ago, and the account still works perfectly, because nothing about leaving a project automatically closes the door behind you.
Roles are the second half of the audit. An administrator can change anything, including other people’s access. Most people who log in to a website do not need that. Someone who writes blog posts needs to write blog posts. Giving everyone administrator access is how a single compromised account becomes a compromised site rather than a compromised blog post.
When you remove an account, WordPress asks what to do with anything that account created. Choose to reassign that content to another user rather than deleting it, or you can lose posts and pages you meant to keep.
Login attempt limits and shared logins
By default, WordPress will let someone guess at your login screen as many times as they like. Automated tools take advantage of that, working through long lists of common passwords at machine speed. Limiting login attempts puts a stop to it: after a handful of failures, that address is locked out for a period. The guessing approach stops being worth anyone’s time almost immediately.
Shared logins are the other loose end. One account used by three or four people is common, it feels efficient, and it quietly removes your ability to know anything. You cannot tell who made a change, you cannot remove one person’s access without disrupting everyone, and the password tends to travel by text message and stay in circulation long after people move on.
The fix is to give each person their own account at the role they need, then retire the shared one. It takes about ten minutes and it makes every future access decision straightforward.
The order to work through this week
If you do nothing else, do these in this order. The first two are where most of the benefit sits.
- Read your user list. Remove accounts for people who have moved on, and reassign their content rather than deleting it.
- Lower the roles that are too high. Leave administrator access with the people who genuinely need to change everything.
- Turn on two-factor authentication for every remaining account. Start with your own, then work through the others rather than leaving it optional.
- Replace any reused password. Your website password should exist nowhere else, and a password manager makes that painless.
- Limit failed login attempts. A small setting that removes an entire category of automated guessing.
- Retire any shared login. Individual accounts at the right role, then the shared one goes.
Every one of those reduces risk. None of them, alone or together, makes a website impossible to compromise, and anyone who tells you otherwise is overselling. What they do is take your site out of the easy category, which is where most trouble happens.
Would rather not do the user list yourself?
Two-factor login security setup is included in every WPSiteOps care plan, along with the access housekeeping that keeps it tidy.
Why this is not a one-time job
Access drifts. A new contractor joins for a project. A plugin adds a service account. Someone leaves and nobody thinks about the website that week, because there are twelve more urgent things. Six months after a tidy audit, the list has grown again, and it grew for perfectly reasonable business reasons.
That is why access review belongs in routine care rather than in a burst of attention once. A quick read of the user list every few months, and whenever someone stops working with you, keeps the list honest. Two-factor login security setup is part of every WPSiteOps care plan from Essential Care up, and the review sits alongside the updates, backups, and monitoring rather than being a separate project.
If you have reason to think something is already wrong, that is a different situation. Our guide on what to do when a WordPress site is hacked covers the order of operations, and malware removal and security cleanup is available as a one-time job.
Frequently asked questions
This is why every two-factor setup gives you backup codes at the moment you turn it on. Save them somewhere that is not your phone, such as a password manager or a printed copy in a drawer. If you lose both the phone and the codes, another administrator on the site can reset your access, which is one practical reason not to be the only administrator.
Yes, and arguably more so. Automated login attempts are not aimed at you personally, they are aimed at every WordPress site at once, and a single account is a single point of failure. Being the only user reduces how much access housekeeping you have to do. It does not change what happens if your one password turns up in someone else’s breach.
For almost everyone it is safer than the alternatives, which are usually a reused password, a note in a phone, or a shared spreadsheet. A reputable password manager stores everything encrypted behind one strong passphrase, and it lets you have a genuinely different password for every site. Protect the manager itself with two-factor authentication as well.
Boring, fast, and worth doing
Nothing in this article is clever. That is rather the point. The measures that prevent the most common way into a WordPress site are an hour of administrative work, and they get skipped precisely because they are dull and nothing is currently wrong.
WPSiteOps looks after hundreds of WordPress sites, which means we have read a great many user lists and found a great many accounts that should have been closed years ago. If you would rather have someone else do the reading, set up two-factor authentication properly, and keep it tidy from there, get in touch and we will take it from you.
Know who can get into your website
Two-factor login security setup, access housekeeping, updates, backups, and monitoring, handled quietly in the background.
Found this useful? Pass it on.
