- Article
- Intermediate
- 2 minutes read
- Reviewed August 4, 2026
Brute-force attacks repeatedly try credentials against a login interface.
Credential stuffing uses username and password pairs stolen from other services.
Automated login traffic can also consume server resources even when it fails.
Strong Authentication
Use:
- Unique generated passwords.
- Password managers.
- 2FA for privileged accounts.
- Phishing-resistant factors where possible.
- Secure email recovery.
- Prompt account offboarding.
Rate Limiting
Limit repeated attempts at the CDN, firewall, web server or application layer.
Controls should consider source address, account, device and distributed behavior.
Avoid permanent lockouts that let an attacker deny access to a known user.
CAPTCHA and Challenges
Challenges can slow automated traffic but can also create accessibility and privacy barriers.
Use them selectively and provide alternatives. They should supplement, not replace, strong authentication.
Monitor Authentication
Alert on:
- Repeated failures.
- Successful logins after many failures.
- New privileged accounts.
- Password resets.
- New application passwords.
- Unusual locations or devices.
- Session changes.
Hide the Login URL?
Changing the login route can reduce noise, but it is not a primary security control.
Attackers can discover other authentication surfaces or target the underlying application.
Frequently Asked Questions
Should accounts be locked permanently after several failures?
Permanent lockouts can be abused for denial of service. Use measured delays, temporary controls and recovery.
Does Cloudflare or another CDN solve login security?
Edge controls can reduce attack traffic, but accounts still need strong authentication and monitoring.
Continue Learning
Previous: [WordPress REST API Security](/resources/wordpress-manual/security/rest-api-security/)
Next: [Spam and Form Security](/resources/wordpress-manual/security/spam-form-security/)