WordPress Login Attack Response Checklist
A WordPress login attack usually appears as repeated requests to wp-login.php or XML-RPC, many failed login attempts, high CPU usage or security plugin alerts. This checklist helps you respond without blocking legitimate access by mistake.
Core principle
First confirm the pattern. Then reduce attack surface. Do not randomly block traffic until you know whether requests are abusive, automated or legitimate.
Checklist
- Check security plugin alerts if available.
- Check Nginx access log for wp-login.php requests.
- Check XML-RPC request volume.
- Identify top IPs and user agents.
- Confirm whether CPU or PHP-FPM is affected.
- Enable login attempt limits.
- Consider CAPTCHA or additional login protection.
- Block abusive IPs only when confirmed.
- Disable XML-RPC if not needed.
- Monitor after mitigation.
Reusable lesson
Login attacks are both a security and resource problem. Even failed login attempts can consume PHP and database resources.
When to Use This Checklist
Use this checklist when WordPress receives repeated login attempts, brute force alerts or suspicious wp-login.php traffic.
Required Tools
WordPress admin, security plugin, Nginx access log, firewall, SSH access, monitoring tool
Before You Start
Do not block search engine or trusted service IPs by mistake. Confirm abusive behavior from logs first.
Structured Checklist Steps
- Check security alerts.
- Check wp-login.php requests.
- Check XML-RPC requests.
- Identify top IPs.
- Check CPU impact.
- Enable login limits.
- Add CAPTCHA if needed.
- Block confirmed abuse.
- Disable XML-RPC if unused.
- Monitor after mitigation.
Verification Steps
- Login attack volume decreases.
- Admin login still works.
- CPU pressure drops if related.
- No legitimate user is blocked.
- Logs confirm reduced abuse.
Rollback Plan
If a firewall rule blocks legitimate access, remove the rule and use a more specific protection method such as login rate limiting.
Common Mistakes
- Blocking IPs blindly.
- Ignoring XML-RPC.
- Using weak admin passwords.
- No login limit.
- Not checking resource impact.
Related Commands
sudo grep "wp-login.php" /var/log/nginx/access.log | tail -n 50
sudo grep "xmlrpc.php" /var/log/nginx/access.log | tail -n 50
sudo awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head
top