WPBeginner - WordPress Tutorials for Beginners

Trusted WordPress tutorials, when you need them most.
Beginner’s Guide to WordPress
WPB Cup
25 Million+
Websites using our plugins
16+
Years of WordPress experience
3000+
WordPress tutorials
by experts

14 Vital Tips to Protect Your WordPress Admin Area (Updated)

By Editorial Staff | | Reader Disclosure

Shares 505 ChatGPT Perplexity X LinkedIn WhatsApp

There’s nothing worse than finding out your website has been compromised. The WordPress admin area is the main entry point for hackers, making it the most critical part of your site to protect.

We know it can be stressful to think about brute force attacks or data theft. Many website owners worry that they don’t have the technical skills to properly secure their dashboard.

The great news is you don’t need to be a security pro to make a huge impact. In our experience managing thousands of WordPress sites, we’ve found that a few straightforward changes are all it takes to build a strong defense.

In this guide, we’ll walk you through the most effective tips for securing your admin area. These simple steps will give you peace of mind and keep your website safe.

Tips and hacks to protect WordPress admin area

We will cover many tips, and you can use the quick links below to jump between them:

1. Use a Firewall

A website application firewall (WAF) monitors your site traffic and blocks suspicious requests before they can reach your server. This is your first line of defense against hacking attempts.

While there are several WordPress firewall plugins, we recommend a DNS-level firewall like Cloudflare. DNS-level firewalls are more effective because they block threats at the network edge, so malicious traffic never even gets to your website.

Website Application Firewall

At WPBeginner, we use Cloudflare’s enterprise plan to protect our website from hacking attempts, malware, and other malicious activity. For step-by-step setup instructions, see our article on how to set up the Cloudflare free CDN for your website.

Another great option is Sucuri, which we previously used. For more details, see our article on why we switched from Sucuri to Cloudflare.

2. Password-Protect WordPress Admin Directory

Another tip that we have found to be extremely effective is adding password protection to the WordPress admin directory. This adds a second layer of defense, requiring two separate passwords to access your dashboard.

You can do this from your WordPress web hosting control panel. Here are the steps for cPanel:

  1. Log in to your WordPress hosting cPanel dashboard and click on the ‘Directory Privacy’ icon.
  2. Select your wp-admin folder, which is typically located inside the /public_html/ directory.
  3. Check the box next to ‘Password protect this directory’ and provide a name for it.
  4. Click ‘Save’, then go back to create a user with a new username and password.
Password protect directory settings

Now, anyone trying to access your admin login page will first see an authentication prompt.

This blocks most automated bot attacks.

Enter password

For more detailed instructions, see our guide on how to password-protect the WordPress admin (wp-admin) directory. Please note that these steps are for hosts using cPanel. If you use a different control panel, check your host’s documentation.

3. Always Use Strong Passwords

Always use strong passwords

You must use strong, complex passwords for all your WordPress accounts. Weak passwords are one of the most common reasons websites get hacked.

A strong password uses a combination of uppercase and lowercase letters, numbers, and special characters (!, #, @, %, etc.). The longer it is, the more secure it will be.

It’s nearly impossible to remember dozens of complex passwords. That’s why our entire team at WPBeginner uses a password manager app like 1Password to securely generate and store unique passwords for every service.

For more information on this topic, see our guide on the best way to manage passwords for WordPress beginners.

4. Use Two-Step Verification on WordPress Login Screen

WordPress login screen with Google Authenticator enabled

Two-step verification, also known as two-factor authentication (2FA), adds another critical security layer. We use 2FA not just on our WordPress websites but on all our online accounts where the option is available.

After entering your password, you must also provide a time-sensitive code generated by an app on your phone, like 1Password or Authenticator. Even if a hacker steals your password, they won’t be able to log in without your phone.

For detailed step-by-step instructions, see our guide on how to set up 2-step verification in WordPress using Google Authenticator.

5. Limit Login Attempts

Limit login attempts

By default, WordPress lets users try to log in as many times as they want. This allows hackers to use automated scripts to try thousands of password combinations in what’s known as a “brute force attack.”

You can easily stop this by installing the Limit Login Attempts Reloaded plugin. After activation, go to Settings » Limit Login Attempts to configure how many failed attempts are allowed before an IP address is temporarily blocked.

For detailed instructions, see our guide on why you should limit login attempts in WordPress.

To learn more about the plugin, you can also check out our detailed Limit Login Attempts review.

6. Limit Login Access to IP Addresses

Warning: This is an advanced technique and should only be used if you have a static (fixed) IP address. Most home internet connections use dynamic IPs that change regularly. If you use this method with a dynamic IP, you will lock yourself out of your own website.

If you have a fixed IP, you can restrict access to your admin area to only that address. Simply add this code to your .htaccess file:

AuthUserFile /dev/null AuthGroupFile /dev/null AuthName “WordPress Admin Access Control” AuthType Basic <LIMIT GET> order deny,allow deny from all # whitelist Syed’s IP address allow from xx.xx.xx.xxx # whitelist David’s IP address allow from xx.xx.xx.xxx </LIMIT>

Don’t forget to replace the ‘xx’ values with your own IP address. You can easily find your current IP address by searching “what is my IP address” on Google. If you use more than one IP address, be sure to add them as well.

For detailed instructions, see our guide on how to limit access to WordPress admin using .htaccess.

7. Disable Login Hints

Disabled login hints

When a login fails, WordPress tells you whether the username or password was incorrect. While helpful for users, these hints also confirm a valid username to an attacker, making their job easier.

You can hide these hints by adding the following code to your theme’s functions.php file. However, we recommend using a code snippets plugin like WPCode. It’s a much safer way to manage custom code without risking site errors.

function no_wordpress_errors(){
return 'Something is wrong!';
}
add_filter( 'login_errors', 'no_wordpress_errors' );
Hosted with ❤️ by WPCode
1-click Use in WordPress

For more details, see our guide on how to add custom code in WordPress without breaking your website.

8. Require Users to Use Strong Passwords

If you run a multi-author WordPress site, a single user with a weak password can create a vulnerability for everyone. You can enforce a strong password policy to prevent this.

To do this, you can install and activate the Solid Security plugin (formerly known as iThemes Security), made by the team at SolidWP.

Then, you can follow the steps in our complete guide on how to force strong passwords on users in WordPress.

9. Reset Password for All Users

For multi-user WordPress sites, you can improve security by forcing all users to reset their passwords. This is especially useful if you suspect a security breach or just want to enforce a new password policy.

First, install and activate the Emergency Password Reset plugin. Upon activation, go to the Users » Emergency Password Reset page and click the ‘Reset All Passwords’ button.

Reset all passwords

For detailed instructions, see our guide on how to reset passwords for all users in WordPress.

10. Keep WordPress Updated

WordPress frequently releases new versions to add features and fix security vulnerabilities. Running an outdated version of WordPress, your plugins, or your theme is one of the biggest security risks you can take.

Always make sure you are using the latest version of the WordPress core software, as well as all your plugins and themes. For more on this, see our guide on why you should always use the latest version of WordPress.

11. Create Custom Login and Registration Pages

For sites that require user registration, such as membership sites or online stores, you should create custom login and registration pages.

This prevents non-admin users from ever needing to see or access the default WordPress login screen. It provides a more professional user experience and allows you to completely lock down the standard wp-admin access without affecting your members or customers.

The easiest way to do this is with a plugin like WPForms, which has a powerful User Registration addon. For detailed instructions, see our guide on how to create custom login and registration pages in WordPress.

12. Learn About WordPress User Roles and Permissions

WordPress has a built-in user management system with different roles and capabilities. Assigning the wrong role can give a user far more permissions than they need, creating a potential security risk.

It is important to understand what each role can do before adding users to your site. Here are the 5 default roles:

  • Administrator: Has full access to all settings and content on the site.
  • Editor: Can publish and manage all posts, including those of other users.
  • Author: Can publish and manage their own posts only.
  • Contributor: Can write and manage their own posts, but cannot publish them.
  • Subscriber: Can only log in and manage their own profile.

For a complete breakdown, see our beginner’s guide to WordPress user roles and permissions.

13. Limit WordPress Dashboard Access

On some sites, certain users may not need access to the WordPress dashboard at all. By default, any user can log in and see the admin area, even if their capabilities are limited.

To fix this, install and activate the Remove Dashboard Access plugin. After activation, go to Settings » Dashboard Access and select which user roles can access the admin area. Others can be redirected to the homepage or another URL.

For more detailed instructions, see our guide on how to limit dashboard access in WordPress.

14. Log Out Idle Users

Idle user logout

Logged-in users who walk away from their computers can pose a security risk. If their computer is public or shared, someone else could access their account.

You can solve this by installing the Inactive Logout plugin. Go to Settings » Inactive Logout and set a time limit. After that period of inactivity, users will be logged out automatically.

For more details, see our article on how to automatically log out idle users in WordPress.

Frequently Asked Questions About Securing the WordPress Admin

What is the most important step to secure my WordPress admin area?

Using a Web Application Firewall (WAF) is the most critical first step. A good firewall, like Cloudflare or Sucuri, blocks malicious traffic before it ever reaches your site, preventing a wide range of attacks.

Is password-protecting the wp-admin directory really necessary?

While not mandatory, it is highly effective. It adds a second layer of authentication that stops almost all automated bots that try to brute-force your login page. It’s a simple change that significantly boosts security.

Can I get locked out of my own site by following these tips?

Yes, if you are not careful. The tip to limit login access to specific IP addresses is for advanced users with a static IP only. If you use a normal, dynamic IP address, you will lock yourself out. Always back up your site before editing files like .htaccess.

Additional Resources for WordPress Security

We hope this article helped you learn some new tips and hacks to protect your WordPress admin area.

You may also want to see our other expert guides for keeping your site safe:

If you liked this article, then please subscribe to our YouTube Channel for WordPress video tutorials. You can also find us on Twitter and Facebook.

Popular on WPBeginner Right Now!

Disclosure: Our content is reader-supported. This means if you click on some of our links, then we may earn a commission. See how WPBeginner is funded, why it matters, and how you can support us. Here's our editorial process.

The Ultimate WordPress Toolkit

Get FREE access to our toolkit - a collection of WordPress related products and resources that every professional should have!

Download Now

Reader Interactions

138 CommentsLeave a Reply

  3. This is great information which I will be implementing ASAP!I have already experienced having my blog hacked so have been worried about these issues.Many thanks!!

    Reply

  8. I’m currently learning wp development. I want to make a ecommerce site with wordpress using the WP e-Commerce plugin. Does anyone know if these tips will keep my ecommerce site secure.

    Reply

  9. Wow – this is an AWESOME post! Thank you so much for sharing all this information – and some great plugins as well!

    In a world where security has become top priority, these are very important things to be aware of with a WordPress installation. Really appreciate your transparency and willingness to share this information! I’ll be tweeting this one. ;)

    Reply

  10. The problem with plugins is that they’re not always compatible with every version, and they aren’t always updated.

    Reply

    • Most plugins are compatible with newer versions, and if the developer decides to leave development of the plugin, others often pick up and create a plugin with fixes for the future releases. You just have to stay active in the community.

      Reply

      Admin

  12. There are also some paid plugins – i.e. “WP Secure” which also claims it is going to make your WP secure from hackers. It also works on the summary of couple of the principles above – i.e. custom made login page, one IP confirmation etc.

    Is it worthy to purchase? = anybody knows if it is easier to use for non-techie than some of the above mentioned?

    Reply

  14. Hi
    Thanks a lot for your tips.
    Regarding tip 8, I wonder how to insert the code
    `add_filter(’login_errors’,create_function(’$a’, “return null;”));`
    What is the complete function to use?
    I’d like to try since I already use AskApache Password Protect and that plugin is incompatible with Secure Wordpress.
    Thanks,
    Kjetil
    – http://www.dolcevita.no

    Reply

    • You go to functions.php and insert that code. Thats all if we understand your question clearly. If this has not answered it, then please reply to the comment and we will surely take a look at it.

      Reply

      Admin

  15. Thanks for this invaluable information. I’ve just suffered a malware attack that put my blog off line for a day or two while I had my Wordpress programmer sort it out. Ver inconvenient.

    I’ll be implementing some of the suggestions you’ve made in the next day or so.

    Robinoz
    http://www.e1jobs-blog.com (All About Jobs blog”

    Reply

  16. good tips for securing wordpress. as time goes we are going to see hosts either become more stringent and secure or cms packages need to implement on install a few more security initiatives.

    Reply

  18. It took me a few minutes to work this one out but you have the wrong kind of quotes around this function

    add_filter(’login_errors’,create_function(’$a’, “return null;”));

    It should be:

    add_filter(‘login_errors’,create_function(‘$a’, “return null;”));

    Other than that, great post.

    Reply

  19. What you can from Wp-PreventCopyBlogs Wordpress Plugin

    1.Track the visitors who try to copy your content.

    2.Record the ip of the user who tries to do fraudulent copy with their landing url of your site and referral url.This can help you to do necessary measures if you notice something bad.

    3.Enable Message displayed to your user upon user’s choice.

    4.Disable Selection of you text and Right Click for users depending on the option.

    Reply

  20. I must congratulate with this excellent article!!! To be honest I know for some tips but some very important info was unknown for me until now!

    Keep on good work :razz:

    Reply

  23. Regarding #6, if you use the following .htaccess file you will be able to login from other locations in a two-step process. This requires you to add a htpasswd file (read your server documentation).

    AuthUserFile ‘some htpasswd file’
    AuthGroupFile /dev/null
    AuthName “WordPress Admin Access Control”
    AuthType Basic

    order deny,allow
    deny from all
    Require valid-user
    # whitelist Syed’s IP address
    allow from xx.xx.xx.xxx
    # whitelist David’s IP address
    allow from xx.xx.xx.xxx
    # whitelist Amanda’s IP address
    allow from xx.xx.xx.xxx
    # whitelist Muhammad’s IP address
    allow from xx.xx.xx.xxx
    # whitelist Work IP address
    allow from xx.xx.xx.xxx
    Satisfy Any

    The “require valid user” and “satisfy any” lines will force the Apache Server to request a Username and Password before you can access the WordPress Login screen. Please DO NOT use the same Username and Password in the htpasswd file that you use for your WordPress access, or you will defeat the purpose of the extra level of security.

    Reply

  26. Hi, I have been blogging for 3 years. My blog got hacked in June 2009 and google banned for 30 days, my pageviews immediately slide from 800 a day to less than 100 a day.
    I highly recommend installing wordpress firewall plugin. The plugin will send your an email every time someone tries to hack your blog together with the hackers IP address. The plugin detects and blocks strange requests, redirecting the attack to the homepage.
    On monday i got an email of six attempted hack attempts over the weekend. The hacker tried the admin page three times when that failed he tried searching wordspew plugin which i dont use.

    To all newbies good luck

    Reply

    • Once a hack is successful the bot or human hacker will keep your data and keep retrying your website files looking for a way back in. they will continue to be relentless. if they have happened to hack your email or computer or server they will keep going until they have hacked everything you touch. they are like cockroaches that found crumbs that led to your house.

      Reply

    • You give them the special URL that you created if you trust them enough. For the most part, guest authors should not even be allowed in the admin panel unless they are authors of your site. If someone has written multiple posts for your site then they can be trustable so you can give them the special url /login or /googlogin or whatever you created.

      Most top blogs take guest posts via email and if those guest authors become regular authors, only then they are allowed in the admin panel.

      Reply

      Admin

  33. Great tips.

    For the involved readers there is an inaccuracy in #6.

    “The downside to this hack is that if you ever want to access the admin panel from some other place, you won’t be able to do so unless you add that extra IP in your .htaccess file.”

    If the ip-address you allow is a box you can can SSH into, you can SSH tunnel through it (I use foxyproxy, because it makes the switch very easy). Also, if you are using nginx instead of apache you can evaluate the URI w/ regular expressions to block everything from wp-app.php to wp-trackback.php (or selectively choose which ones you do not want to block). I cover this @ http://www.phrison.com/securing-arbitrary-uris/ but it is not for the unexperienced.

    I have a large collection of tin-foil hats.

    Reply

  37. This site is a happy new find for me (FYI,thanks to @Problogger on Twitter), and I’m looking forward to further exploration. This article is the kind of tight, clear writing that is too rare these days. Thanks for some genuinely helpful information.

    Reply

    • We are glad that you like our site, and we are also very glad that Darren found the article useful enough to tweet it. We hope you follow us on twitter so you can stay up to date with all the nice tutorials.

      Reply

      Admin

  38. Wow – I’m fairly new to WP and had no idea there were so many gateways for hackers. I’m sure they won’t find their way in after adding a few of these.

    Thanks.

    Reply

  39. WordPress security is a growing issue and these steps are critical for securing a WordPress site. Beefing up security helps the entire community as well as your own site to take time to implement these ideas. Well done.

    Reply

  41. A good list of vital tips to secure your site. I particularly like #8 I’ve never done this before but will from now on!

    Regarding #7 – Remove ‘admin’ username:

    I don’t remove the admin username, I create a new admin account then change the ‘admin’ users account type to subscriber.

    That way, even if someone does crack the password it’s a useless account. If you remove it, someone can register that username…

    Reply

  42. Thank you for all the suggestions, I’m working on a few big projects and this will certainly help once the blogs are up and running.

    First time here and I’m loving the blog, good job!

    Dan

    Reply

    • Yes you can do that, but in this article we were only talking about WordPress Admin Panel not the entire site in general. There are many other ways to protect your site entire WordPress blog.

      Reply

      Admin

  49. Hey this is a wonderful collection of tips and hacks, very useful. I recommend every WP blogger to go through the list and follow the steps as well as any other useful resources available elsewhere. After all we have NOT set up our blogs so someone shall take control of our lives. Damn.

    Thanks for sharing, WPBeginner.

    Reply

Leave A Reply

Thanks for choosing to leave a comment. Please keep in mind that all comments are moderated according to our comment policy, and your email address will NOT be published. Please Do NOT use keywords in the name field. Let's have a personal and meaningful conversation.

Copyright © 2009 - 2025 WPBeginner LLC. All Rights Reserved. WPBeginner® is a registered trademark.

Managed by Awesome Motive | WordPress hosting by SiteGround

The WordPress® trademark is the intellectual property of the WordPress Foundation. Uses of the WordPress®, names in this website are for identification purposes only and do not imply an endorsement by WordPress Foundation. WPBeginner is not endorsed or owned by, or affiliated with, the WordPress Foundation.

I need help with…

Popular searches:

Starting a Blog WordPress SEO WordPress Performance WordPress Errors WordPress Security Building an Online Store