How to Stop Password Guessing on Every WordPress Site You Manage

Short answer: lock an address out of the login page after a few failed attempts, require two-factor authentication for administrators, keep the number of admin accounts small, and watch failed logins across all your sites from one place so you notice an attack while it is happening. For an agency, the last point matters most: the attack you never see is the one that works.

What does a password guessing attack look like today?

Password guessing (a brute-force attack) is a script trying usernames and passwords on wp-login.php or xmlrpc.php until one works. In 2026 it rarely comes from a single address. Here is a real pattern from one agency client site, on a single day:

Source	Attempts	What it is
About 15 addresses in one block	20 each	Exit addresses of a commercial VPN service
1 address	100	A cloud provider's network
1 address	51	A hosting company's server

Two things stand out. The attacker moves to a new VPN address after exactly 20 tries, to stay under simple "block after N attempts" rules. And none of the sources is a person at home: they are rented servers and VPN exits. Close to 600 failed logins on one site, in one day, and the site owner had no idea.

Why one security plugin per site is not enough for agencies

A login security plugin on each site works, but it leaves an agency with three problems:

• Nobody is watching. Each site counts its own attacks in its own dashboard. Nobody opens forty dashboards to look.
• Settings drift. One site locks after 5 attempts, another after 20, a third has the plugin switched off since a conflict last year.
• No shared memory. An address attacking thirty of your sites is treated as a stranger on each one.

The five protections that matter

1. Lock out addresses after a few failed logins

Lock an address out of the login page after around 5 failed attempts, for 15 minutes, and double the lockout each time it comes back. Keep the rest of the site open to it, so a shared office address that mistypes a password does not take the whole site offline for a client. Against the VPN pattern above, this cuts each address from 20 tries to 5: three quarters of the attack gone, automatically.

2. Require two-factor authentication for administrators

A guessed password is useless without the second factor. Start with administrators and anyone who can install plugins.

3. Keep administrator accounts few and named

Every extra admin is another password to guess. Remove unused administrators, avoid shared logins such as "admin" or the agency name, and give each person their own account so you know who did what.

4. Watch failed logins across every site

Count failed logins per site, per day, and look for jumps: 50 or more in a day, or five times a site's usual number, is worth a look. See which addresses are behind them and who owns them, because "a VPN service" and "a hosting company" tell you it is automated.

5. Use what your host already does

Some hosts block repeated failed logins at the server (Imunify360 on Cloudways, for example). That is a good first layer. Keep your own lockout too: it covers sites on other hosts and gives you the numbers.

How Glow handles this across all your sites

Glow Security applies these protections from one place, for every client site:

• Login protection: an address is locked out after 5 failed logins for 15 minutes, doubling each time it returns. The rest of the site stays open. Sites already running Wordfence or another login plugin are left to it.
• Password guessing alerts: the dashboard flags any site seeing heavy password guessing while nothing is blocking it, with a one-click way to turn protection on.
• Failed logins by address: each site lists the addresses behind its failed logins, with the network owner and whether it is a VPN, cloud or hosting network. Glow never collects the usernames tried.
• WordPress admin 2FA and account review: WordPress Access lists every login on every client site, flags unused or unexpected administrators, and can require two-factor authentication.

Glow Security starts in Passive mode, where it counts and reports but changes nothing. Turn it On for one site or for all of them when you are ready. It is included in every plan.

Frequently asked questions

How many failed logins a day is normal for a WordPress site?

Most small business sites see a handful to a few dozen failed logins a day from background scanning. Hundreds in a day, or a sudden jump to five times the usual number, means someone is actively guessing.

Should I block VPN addresses completely?

No. Your client or their staff may use a VPN. Lock out the addresses that fail repeatedly instead: real users get through, scripts get stopped after a few tries.

Is renaming wp-login.php enough?

It reduces noise from basic scanners but does not stop a targeted attack, and it can break plugins and confuse clients. Lockouts and 2FA do more.

What about xmlrpc.php?

If no app or service on the site uses XML-RPC, turning it off removes a second door for password guessing. Glow's hardening options include this as a switch, with a note on what it can break.

Will lockouts block my own clients?

Only after repeated failed logins from the same address, and only from the login page. A client who gets locked out can be let back in from the Glow dashboard using the reference code shown on the lockout page.

Start free with Glow: free for your first site, no credit card.