Cyber security should be taken seriously. The number of WordPress websites getting hacked is directly proportional to the lack of awareness among site owners.
I have been building sites with WordPress since 2010, I often see site owners’ negligence towards securing their sites.
In this short post, I will discuss why renaming the login page is not a great security measure.
Some developers and site owners assume that hacking attempts can be prevented by changing the WP login URL.
In reality, it is not a good approach. Let me explain why!
Plugin conflicts
Many plugins hook into the login page methods to display messages, alter the look of the page, etc.
Page builders like Elementor and others now allow users to add a login form easily without writing a single line of code.
While this is easier to implement, it also opens doors for vulnerabilities.
As you see, now there are many ways to log in to WordPress, it is not the wp-login.php only.
security by obscurity
Hiding the login page is not an effective way of protecting it. Read more about this security by obscurity concept here.
Instead, you should make the authentication a secure process.
Common ways to secure WP Login
Adding a captcha to prevent brute-force attacks.
Using a plugin like Limit Login Attempts to lock failed login attempts.
Login by Auth0
I have made all these mistakes listed above, somehow the hackers found their way in.
It all stopped when I started using 2FA.
Nowadays I use login authentication by Auth0.
Their free tier is more than enough for any site to get started. You are given options like 2FA, MFA, passwordless, and more.
If you are new to Auth0, don’t get overwhelmed. It is easy to set up. Take a look at a video tutorial on setting up Auth0 with WordPress.
Want to see it in action? Here is my login page
Hat tip to Chris Wiegman’s post on this topic and some recent hack attempts on my friend’s site!
Leave a Reply