WP-Admin
WP-Admin is the WordPress dashboard, reached at yoursite.com/wp-admin, and because that address is the same on every WordPress site it is the most attacked page you have.
In plain English
Everything you do as an owner happens behind it: posts, plugins, users, settings. Everything an attacker wants happens behind it too.
The login form sits at wp-login.php, and bots try it constantly on every WordPress site on the internet, whether anyone has heard of yours or not.
Why it matters
Almost every WordPress site that gets taken over is taken over through a guessed or reused password on this one form.
The good news is that the fixes are quick and permanent, and none of them require you to understand security in any depth.
How it works
-
The login form takes a guessUsername and password, unlimited tries by default.
-
Limiting attempts stops the botsA few failures from an address, and it is locked out for a while.
-
Two factor stops the restA code from your phone that a stolen password does not include.
-
Changing the address hides the doorA custom login URL means the automated traffic never finds the form.
Write the new login URL down first
If you change the address and then forget it, you are locked out of your own site and the way back in is a database edit.