Brute-force attacks hammer wp-login.php with password guesses. Limiting attempts stops them.
- Install a plugin like Limit Login Attempts Reloaded, which locks out an IP after a few failed tries.
- Use a security plugin such as Wordfence for built-in brute-force protection and a firewall.
- Add a CAPTCHA to the login form, and use strong, unique passwords plus two-factor authentication.
For extra protection, you can restrict /wp-admin with cPanel's Directory Privacy or limit wp-login.php by IP in .htaccess. cPanel's ModSecurity and Imunify360 also block many attacks at the server level. These layers together keep attackers out. If you are seeing heavy attacks, open a ticket for help.
