Tag: how-to

A WordPress site’s login endpoint (/wp-login.php) is a common target for brute force attempts and bad actors. On WordPress VIP, brute force attempts on a site’s /wp-login.php are detected and mitigated at the edge (i.e., firewall, NGINX). Dynamic security protocols are in place that can be triggered by unusual behavioral patterns to protect against unauthorized access and abuse of the login endpoint. An automated attack will trigger VIP’s dynamic security measures, and login attempts will be completely blocked.

By default, a user that logs in to a WordPress site only stays logged in for 48 hours. The duration of logged-in session time increases to 14 days if the user toggles the option labeled “Remember Me” when entering their login credentials to the login portal.

Users with login access can play an important role in maintaining the security of a WordPress site by following security best practices. Following security best practices is increasingly important for users that have roles with greater capabilities.