Out of the box, WordPress does not limit how many times someone can try to log in. That single gap is why the wp-login.php page is one of the most consistently attacked URLs on the internet, on sites large and small.
The scale of the attacks
Wordfence reported that its firewall blocked over 19.2 billion brute force attacks against the more than 5 million WordPress sites it protects, in the third quarter of 2025 alone. These are not targeted attacks on your specific business, they are automated bots working through lists of common usernames and leaked passwords against every WordPress site they can find.
Why "admin" is still a problem
Sites set up years ago, or restored from an old backup, often still run on a user named "admin". That username needs no guessing, which cuts the attacker's job in half: only the password is left to brute-force. The same applies to any username that matches the site's own author or support email address, since that is often visible in page source or old blog posts.
What WordPress.org itself recommends
WordPress's own developer documentation is direct about where the responsibility sits: "Enable two-factor authentication (2FA) for all administrator accounts (use a plugin or your identity provider; WordPress core does not include 2FA)." It also recommends to "rate-limit login attempts at the edge (WAF/CDN) or the web server."
Three fixes this week
- Rename or remove any account still called "admin", and check no account is reusing a password from elsewhere.
- Turn on two-factor authentication for every administrator account.
- Rate-limit or lock out repeated failed logins, at your CDN, your server, or with a security plugin if neither is available.
AuditMerlin does not test your login form directly, but it does check the broader WordPress security posture, headers, HTTPS and version disclosure among them. A free scan is a good companion check once your login page is locked down.