Fairly new to running my own WordPress site and I got a fright the first time I opened the login logs, dozens of failed attempts a day from IPs all over the place. From what I've read since, this is mostly background noise: automated bots spraying credentials at the default login on basically every install, and unless the numbers are huge or paired with other symptoms it isn't a targeted attack. I tightened the obvious things, a strong unique password, a second factor on the admin account, and capping how many tries an IP gets before it's locked out, and the volume dropped noticeably.

Two things I'd love a reality check on from people who've run sites longer: at what point should a spike in failed logins actually worry me versus just being noise, and is limiting attempts + 2FA genuinely enough on its own, or is there one more thing you'd treat as non-negotiable? Don't want to bolt on five plugins for a problem that's already handled.

Been going back and forth on this one. My logs fill up with failed logins on the default /wp-login.php every day, as far as I can tell it's just bots hitting the same path they hit on every WordPress site, nothing targeted at me. Limiting attempts and adding a challenge to the form quieted most of it, but I keep wondering whether moving the login off the default path is genuinely worth it or just security-through-obscurity that breaks more than it fixes.

For those of you who've hidden the login URL: did it actually cut the noise in your logs, or did it mostly create headaches with things that expect wp-login.php (mobile app, integrations, the odd plugin)? And if you deliberately don't hide it, what's your reasoning, rate-limiting at the edge and calling it done? Trying to figure out where the real payoff is before I fiddle with it further.