Your access logs fill with POST requests to wp-login.php. Nobody on your team is logging in at 3 a.m. from another continent. That is not curiosity. That is bots guessing passwords until something gives.
WordPress is a popular target because everyone knows where the front door is. Rate limiting and brute force protection slow those guesses down. They do not replace strong passwords, updates, or MFA, but they stop a noisy attack from eating CPU and eventually getting lucky.
What brute force looks like on WordPress
Attackers hammer:
/wp-login.phpand/xmlrpc.php- Custom login URLs if plugins moved them (bots still find them eventually)
wp-adminredirects and REST endpoints when misconfigured
Symptoms on your side: slow site, hosting warnings about CPU, failed login emails (if enabled), security plugin alerts, or nothing at all until an account is compromised.
Shared hosting makes this worse because one shop's login storm can affect neighbors. VPS owners still pay in CPU and log noise.
Rate limiting in plain terms
Rate limiting means: after N failed attempts from an IP (or username) in a time window, block or delay further tries. Good rules balance security with real users who typo their password twice.
Layers that work together:
- Web server (Nginx/Apache modules, fail2ban on VPS)
- WAF or CDN (Cloudflare rate rules, managed WAF on some hosts)
- WordPress security plugins (login lockout, captcha on wp-login)
- Hosting-level firewall when your provider offers one
One layer is minimum. Two is better for public sites. See DDoS protection questions for your host for how edge filtering fits bigger traffic spikes.
Practical settings we like
Lock out after 3 to 5 failures per IP in 15 minutes. Longer lockout (hours) for repeat offenders.
Disable or restrict xmlrpc if you do not use Jetpack mobile, pingbacks, or remote publishing. Many sites do not need it open.
Hide login URL is optional. It cuts scanner noise but is not security by itself. Do not skip MFA because the URL changed.
Captcha or turnstile on wp-login after a few failures, or always if bots are relentless. Annoying for humans, effective against dumb bots.
Block country traffic only if your audience is truly local and you accept false positives. Canadian businesses with global customers should be careful.
Never use admin as a username. Old installs still have it. Rename or delete that account.
MFA beats almost everything else
Rate limits slow guessing. MFA means a stolen password is not enough. Enable MFA on every admin and editor account, and on hosting, DNS, and email. We wrote about that in MFA on your hosting and DNS accounts.
Application passwords (for REST or integrations) should be scoped and revocable. Audit them quarterly.
When plugins become the problem
Security plugins help until they conflict with caching, break REST for your mobile app, or lock out your office IP because everyone shares one NAT address.
Test lockout rules on staging. Whitelist your office IP if you must, but document it. Prefer user-level MFA over permanent IP allowlists that never get cleaned up.
Heavy plugins on every login attempt add latency. If admin feels sluggish, check whether security scanning runs on each POST.
VPS and managed hosting differences
On a VPS you can run fail2ban, customize Nginx rate zones, and ship logs to a SIEM if you are that organized. You also own misconfiguration.
On managed WordPress or shared hosting, use the host firewall panel plus a reputable plugin. Ask support what they already block at the edge before you double up blindly.
Either way, keep WordPress core, themes, and plugins updated. Brute force is often the second step after a known vulnerability.
After a successful guess
If an account is compromised, rate limits failed too late. Follow WordPress hacked: first 48 hours: rotate passwords, check admin users, review plugins, restore from clean backup if needed.
Bottom line
WordPress login endpoints will get probed. Rate limiting and lockouts turn a firehose into something your server can ignore. Pair that with MFA, no reused passwords, and sane xmlrpc exposure so brute force stays an annoyance, not an outage.
Want help tuning firewall rules on Canadian hosting or cleaning up after a login storm? Talk with Swift Host. We see this weekly and prefer prevention over emergency restores.
