How to choose and roll out two-factor authentication on WordPress
Two-factor authentication makes a stolen password useless. How TOTP works, where passkeys fit, methods to avoid, rolling it out by role, and a fallback plan so…
Category
Attacks and brute force
Brute force, credential stuffing, bots: understand attacks on logins and how to stop them.
How to limit login attempts on WordPress: thresholds, durations and pitfalls
Blocking an address after a few failures looks simple. In practice, the threshold, the duration, proxies like Cloudflare and shared addresses decide whether the protection stops…
How to spot and stop a brute force attack on WordPress
Dictionary attacks, credential stuffing, networks of compromised machines: what really happens behind the thousands of login attempts a WordPress site receives, and the defenses that matter.
How to secure the WordPress login page: the complete guide
The seven protections for the WordPress login page, ranked by priority, with the right setup for each type of site and the mistakes that lock you…