The Two URLs Every WordPress Attacker Tries First (And How to Stop Guessing Being a Risk)
If you've ever checked your WordPress server logs, you've seen it: a steady stream of requests to /wp-login.php and /wp-admin from IPs you've never heard of, at all hours, with no referrer. That's not targeted. It's automated. Every WordPress site on the internet gets this traffic, because the login URL is the same on every default install, which means a bot written once works against millions of…
WordPress sites frequently receive automated traffic targeting the default login URL, /wp-login.php and /wp-admin, from unknown IP addresses at all hours. This is not targeted traffic but rather automated scans by bots. The default login path cannot be changed by WordPress itself as it is relied on by countless plugins, documentation, and integrations.
The consistent pattern of these attacks involves steady request rates, usernames clumping around 'admin', the site's domain name, and common first names, and no referrer or JavaScript execution. These are raw POST requests from bots, not human-driven forms. Rate-limiting is more effective against this threat than CAPTCHA, as bots do not have infinite patience for slowing down due to rate limits.
To observe this on your own site, you can add a custom action to log failed login attempts with the source IP address. This pattern of attacks poses a risk to all WordPress sites, regardless of whether they have custom login URLs. Pairing a custom login URL and rate-limiting can address both the volume of attacks and the determined attackers, offering two complementary controls.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
