News for hackers. Stuff that matters.

A comment on With Admins Still Choosing ‘Admin’, WordPress Password Troubles Continue.

Re:With Admins Still Choosing ‘Admin’, WordPress Password Tr... by quickco on Sunday January 01, 2023 @07:40PM (#34212849)
One of the best security Auth configurations for WordPress is:

+ Change login URL from /wp-admin/ to something unique such as /custom-login. This stops the majority of bots as they usually only target /wp-admin

+ disable “admin” username

+ automatically block the IP address of any attempt to log in using “admin” username.

+ block IP address of x failed login attempts for y minutes.

This can be achieved by many free and commercial WordPress security plugins.

[ Parent | on HN ]
Re:With Admins Still Choosing ‘Admin’, WordPress Password Tr... by lfodofod on Monday January 02, 2023 @01:43AM (#34215078)
Or don’t do any of those things and use an adequate password instead.
[ Parent | on HN ]