CMS Security
WordPress Login Page Access Check (wp-login.php)
The wp-login.php page is the primary target for brute‑force attacks on WordPress. Learn how to secure it with a CAPTCHA, login attempt limiting, and other protection measures.
What this test checks
This test checks whether the WordPress login page (wp-login.php) is accessible and protected by a CAPTCHA. Without protection, this page is exposed to brute‑force attacks, where automated scripts try to guess your login credentials. Effective protection is essential to prevent unauthorised access to your dashboard.
Our recommendation
Protect wp-login.php with a CAPTCHA using a security plugin (e.g., Google reCAPTCHA, hCaptcha, or Wordfence's security module). Limit login attempts with a plugin like Login Lockdown or Limit Login Attempts. Change the default login URL using a plugin like WPS Hide Login to reduce automated attacks. Enable two‑factor authentication (2FA) for enhanced security.
Security tests
Read more
CMS Security