Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Protect WordPress administration with several independent controls rather than a hidden login URL alone: force HTTPS, give every administrator a unique password and phishing-resistant two-factor authentication, rate-limit both /wp-login.php and /xmlrpc.php, keep all software patched, and put a managed WAF or equivalent edge filter in front of the site when attack volume warrants it.
Apply restrictions carefully. Logged-out requests to /wp-admin/ are redirected to /wp-login.php, and a blanket password or IP rule on the admin directory can break wp-admin/admin-ajax.php. The safest rollout is layered, tested, and accompanied by a documented administrator recovery path.
What you are protecting
/wp-login.php is the login script in the site root. /wp-admin/ is the administration area; when a visitor is not authenticated, WordPress normally sends that request to the login page. Attackers therefore target both paths, along with the XML-RPC endpoint, to guess passwords, test stolen credentials, or consume server resources.
Not every control addresses the same threat. A password rule helps against guessing, two-factor authentication helps when a password has been stolen, and a WAF can stop abusive requests before they consume PHP workers. Combining controls means one missed or bypassed layer does not expose the account.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
The protection stack at a glance
| Control | Where it runs | Primary protection | Compatibility and recovery considerations |
|---|---|---|---|
HTTPS with FORCE_SSL_ADMIN |
Web server and WordPress configuration | Encrypts credentials, cookies, and authentication headers in transit | Requires a valid certificate and correct HTTP-to-HTTPS redirects; keep an emergency way to edit configuration if a redirect is misconfigured |
| Unique passwords and a password manager | Administrator accounts | Reduces password reuse and guessing risk | Every administrator must maintain access to the manager and the account recovery email |
| Two-factor authentication | WordPress account or identity provider | Blocks most password-only account takeovers | Use backup codes or a second administrator for recovery; test the recovery process before enforcing it |
| WebAuthn or passkeys | Maintained WordPress security plugin or identity provider | Phishing-resistant login proof tied to the device or security key | Confirm browser, device, and plugin support and register a backup authenticator |
| Rate limiting | Preferred: edge/WAF; alternatively web server or WordPress plugin | Credential guessing and request floods against login endpoints | Set thresholds that do not lock out legitimate staff; edge limits preserve origin resources better than PHP-only limits |
| XML-RPC policy | WAF, web server, or WordPress configuration | Prevents abuse of /xmlrpc.php |
Disabling it can break Jetpack, the WordPress mobile app, or another integration; restrict and throttle it when it is required |
| Managed WAF | Network edge before the origin server | Bot challenges, abusive-IP blocking, and high-volume attack absorption | Check DNS and origin access during setup; retain a way to bypass or adjust a false-positive rule |
| BasicAuth or IP allowlist | Web server in front of admin requests | Adds a second gate for a controlled office or VPN network | A blanket rule on /wp-admin/ can break admin-ajax.php; scope exceptions and test every required workflow |
1. Require HTTPS for the entire site
Administration should never accept credentials over plain HTTP. HTTPS encrypts the login request, session cookies, and authentication headers between the browser and the server. WordPress documents FORCE_SSL_ADMIN for this purpose; FORCE_SSL_LOGIN was deprecated in WordPress 4.0.
Set the WordPress constant
- Obtain and install a valid TLS certificate for every hostname administrators use.
- Configure the web server or host to redirect HTTP requests to HTTPS and verify that the redirect does not loop.
- In
wp-config.php, adddefine( 'FORCE_SSL_ADMIN', true );above the line that says WordPress has stopped editing the file. - Sign out, visit the login page with an
http://address, and confirm that it reaches the HTTPS URL before any credentials are entered. - Test the dashboard, media uploads, plugin screens, and logout in a private browser window. Mixed-content warnings or redirect loops indicate a proxy, URL, or certificate configuration problem that must be corrected before enforcing the setting for all administrators.
Do not rely on a browser padlock alone. The redirect, WordPress URLs, cookies, and any reverse-proxy settings must all agree that HTTPS is the canonical scheme.
Recommended Free Tools
2. Harden every administrator identity
Use unique credentials
Give each person an individual account and remove unused administrator accounts. Use a long, randomly generated password that is not reused on another service, and store it in a reputable password manager. Do not share one administrator login: individual accounts make audit records meaningful and let you revoke one person’s access without changing everyone else’s password.
Require two-factor authentication
Current WordPress hardening guidance calls for two-factor authentication (2FA) for every administrator. WordPress core does not provide 2FA by itself, so install a maintained security plugin or connect an identity provider that supports it. Prefer an authenticator method with a recovery process that your team has tested; one-time codes are better than a password alone, while a hardware security key or passkey provides stronger phishing resistance.
- Create a second administrator or recovery account with a separate, protected authenticator before enforcing 2FA for the first account.
- Install the chosen, actively maintained 2FA or identity integration through a trusted administrative workflow.
- Enroll each administrator, save the generated recovery codes offline, and verify a fresh login in a private browser session.
- Require 2FA for the administrator role rather than merely enabling it as an optional user preference.
- Revoke lost devices promptly and rotate recovery codes after they are used.
Use passkeys or WebAuthn when supported
WebAuthn and passkeys bind the login proof to the legitimate site and an enrolled device or security key, making common phishing pages ineffective. Support depends on the maintained WordPress plugin or identity provider, the browser, and the device. Register at least two authenticators where the system permits it, and keep the documented recovery route available.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
3. Rate-limit the real attack endpoints
Apply limits to /wp-login.php and /xmlrpc.php, not only to the visible dashboard path. A limit at the edge or web server can reject abusive traffic before it starts WordPress and PHP work. A plugin-level limiter still helps, but requests have already consumed origin resources by the time PHP evaluates them.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesChoose a sensible policy
- Count failed authentication attempts by source address and, where your WAF supports it, by account or other risk signals.
- Use progressive delays, temporary blocks, or a challenge instead of a permanent ban that can strand a legitimate administrator behind a shared corporate address.
- Apply a separate, stricter policy to obvious automation while allowing normal staff logins from changing residential or mobile addresses.
- Log the rule, threshold, duration, and the exception process so another administrator can adjust it during an incident.
Why edge enforcement matters
Distributed attacks can rotate through many addresses. A managed WAF or host-provided WAF can challenge bots and block traffic at the network edge, preserving origin CPU, memory, and PHP workers. WordPress’s brute-force guidance names Cloudflare, Sucuri, and host WAFs as examples of this type of protection. Configure the WAF to pass legitimate administrator traffic and verify that the origin cannot be reached directly around the WAF.
4. Decide what to do with XML-RPC
/xmlrpc.php is separate from the browser login form and can be abused for authentication attempts or request floods. Disable it when the site has no integration that needs it. If Jetpack, the WordPress mobile app, publishing tools, or another approved integration depends on XML-RPC, do not block it blindly.
When disabling is appropriate
- List every service that publishes, synchronizes, or manages the site.
- Disable XML-RPC at the WAF, web server, or WordPress layer.
- Test publishing, mobile administration, remote monitoring, and any connected service.
- Monitor logs for failed calls. If a required integration stops working, restore access and use allowlisting plus strict rate limiting instead.
When restriction is safer
For a required integration, permit only the methods or source networks it needs when your WAF supports that granularity, require HTTPS, and rate-limit the endpoint independently from /wp-login.php. Record the exception and review it whenever an integration is removed.
5. Keep WordPress, themes, and plugins current
Outdated plugins and other software remain a major attack category. Enable a dependable update process for WordPress core, themes, and plugins, and remove components that are no longer maintained or used. Before a substantial update, keep a tested backup and a way to restore the site; after updating, check the login page, dashboard, forms, checkout or publishing workflows, and any XML-RPC-dependent service.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
- Use the WordPress update screen or your host’s managed process, and review what changed.
- Do not install abandoned security or login plugins merely because they add a feature; maintenance and compatibility matter more than a long settings list.
- Separate update permissions from day-to-day content editing when your team structure allows it.
6. Treat a changed login URL as noise reduction, not security
A plugin that changes the public login address can reduce automated requests aimed at the default path. It does not protect a discovered URL, stolen credentials, vulnerable plugins, or an unencrypted connection. Keep HTTPS, 2FA, endpoint rate limits, updates, and WAF controls even if you use a custom login URL.
Document the new address and a recovery procedure. A misconfigured login-hiding plugin can lock out every administrator; maintain a server- or host-level way to disable it, and test that procedure before an incident.
7. Add BasicAuth or an IP allowlist only with careful scope
A second password prompt or an allowlist for a private office or VPN network can reduce exposure, especially for a small team with predictable source addresses. It is not a replacement for WordPress 2FA, because an allowed network or shared BasicAuth credential can still be compromised.
Protect the right paths
Do not blindly protect every request under /wp-admin/. WordPress documentation warns that securing the directory can break functionality such as wp-admin/admin-ajax.php. Scope the rule to the login path and the administrative screens that genuinely need it, or create an explicit exception for admin-ajax.php and any other required endpoint.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Test before enforcement
- Apply the rule in a staging site or to a narrow administrator group.
- Test login, logout, dashboard navigation, media uploads, the block editor, plugin settings, scheduled tasks, and AJAX-driven screens.
- Test from every legitimate network, including the VPN and a recovery connection.
- Publish the rule only after confirming that the support team can remove or modify it without WordPress dashboard access.
8. Monitor authentication and plan recovery
Record failed logins, successful administrator logins, 2FA failures, password resets, changes to administrator roles, and WAF blocks. Review unusual bursts, unfamiliar locations, impossible travel, repeated attempts against disabled accounts, and activity immediately after a plugin or theme change. Monitoring is useful only if someone is responsible for responding.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Keep an administrator recovery path
- Maintain a separate emergency administrator account with a unique password and protected 2FA method; use it only for recovery and audit it regularly.
- Store WAF, web-server, hosting, and DNS access separately from the WordPress dashboard.
- Keep offline recovery codes and current backups, and document who can approve an emergency unlock.
- If an allowlist or rate limit locks everyone out, remove or adjust the rule at the edge or server first; do not repeatedly guess passwords.
Respond to a suspected compromise
- Preserve logs and note the time window.
- Temporarily restrict administrator access at the edge while keeping the recovery path available.
- Reset affected passwords, revoke active sessions, replace 2FA secrets where necessary, and remove unknown administrator accounts.
- Update core, themes, and plugins, then inspect recently changed files and configuration.
- Re-enable normal access only after confirming that the source of the compromise and any malicious persistence have been addressed.
A practical rollout order
- Install and verify HTTPS, then enable
FORCE_SSL_ADMIN. - Inventory administrators, remove unused accounts, and issue unique passwords.
- Enroll and enforce 2FA; add passkeys or WebAuthn where the maintained integration supports them.
- Rate-limit
/wp-login.phpand/xmlrpc.phpat the edge or web server. - Choose a deliberate XML-RPC policy based on actual integrations.
- Put a managed WAF in front of the site if the host or traffic pattern justifies it, and verify origin access controls.
- Update and remove unsupported software.
- Optionally add a changed login URL or narrowly scoped BasicAuth/IP controls after testing compatibility.
- Turn on authentication monitoring and rehearse administrator recovery.
Troubleshooting common failures
Administrators see a redirect loop after enabling HTTPS
Check the certificate, canonical WordPress URLs, reverse-proxy HTTPS headers, and the order of HTTP-to-HTTPS redirects. Temporarily revert the constant through the host or file access, correct the proxy configuration, and test again in a private browser.
The dashboard loads but a plugin screen is broken
Inspect BasicAuth or IP rules for blocked AJAX requests. Add the narrowly required exception for admin-ajax.php, then retest the specific screen rather than removing all protection.
Jetpack or the mobile app stopped working
That integration may require XML-RPC. Restore the endpoint, restrict it to the required traffic where possible, and apply a dedicated rate limit instead of leaving it unrestricted.
Legitimate staff are repeatedly challenged or blocked
Review the WAF signal and the rate-limit scope. Shared office addresses, mobile networks, and privacy relays can make an address-only rule too aggressive. Add a controlled exception or use a challenge and 2FA rather than a permanent allowlist.
An administrator lost the second factor
Use the pretested recovery account or offline recovery codes, revoke the lost authenticator, enroll a replacement, and rotate any codes that were exposed. Do not disable 2FA for every administrator to solve one account’s problem.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Final verification checklist
- HTTP administration redirects to HTTPS and
FORCE_SSL_ADMINis active. - Every administrator has an individual account, unique password, and enforced 2FA.
- At least one phishing-resistant passkey or security key is available where supported, with a backup authenticator.
/wp-login.phpand/xmlrpc.phpare rate-limited before PHP when practical.- XML-RPC is disabled or has a documented integration exception and limit.
- Core, themes, and plugins are maintained and unnecessary components are removed.
- Any custom login URL, BasicAuth, or IP rule has been tested with
admin-ajax.phpand all legitimate networks. - WAF, server, DNS, and WordPress recovery access are documented and separate.
- Failed authentication and administrator changes are reviewed by an assigned person.
Frequently Asked Questions
Is hiding wp-login.php enough to stop brute-force attacks?
No. A changed login URL may reduce automated noise, but it does not replace HTTPS, administrator 2FA, endpoint rate limiting, updates, or WAF filtering.
Should I always disable XML-RPC?
Disable it when no approved integration needs it. If Jetpack, the mobile app, or another service requires XML-RPC, restrict and rate-limit the endpoint instead of blocking it outright.
Can I put all of wp-admin behind BasicAuth?
You can add a second gate, but a blanket rule may break wp-admin/admin-ajax.php and other workflows. Scope the rule, test every administrative function, and keep a server-level recovery path.
What is the best way to recover if rate limiting locks me out?
Use the documented emergency account or adjust the rule at the WAF or web-server layer, then review the threshold and add a controlled exception. Do not remove 2FA from all administrators.
The Bottom Line
Secure WordPress administration in layers: HTTPS and FORCE_SSL_ADMIN, unique administrator credentials with enforced 2FA, phishing-resistant passkeys where supported, edge rate limits on both login endpoints, a deliberate XML-RPC policy, timely updates, and carefully tested WAF or network restrictions. Login-url changes and directory passwords are optional supplements, never the foundation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
