Articles / Sign-in Security
WordPress login security
Most WordPress break-ins start at the sign-in page. These WordPress login security articles cover admin usernames, sessions, lockouts and the settings that keep the front door shut.
RSS FeedLatest WordPress login security articles
How to Change Your WordPress Admin Username (Safely)
WordPress will not let you rename a user from the profile screen. Here are three safe ways to change your WordPress admin username, and the leaks to check afterwards.
Read articleWordPress Auto Logout: How to Sign Out Idle Users
WordPress keeps people signed in for days by default. Here is how WordPress auto logout works, how to shorten it with code or a plugin, and how to end a session you do not trust.
Read articleWordPress User Roles: What Each One Can Do and Who Gets What
WordPress user roles decide who can publish, who can install plugins and who can take the whole site over. Here is what each role can do and how to hand them out safely.
Read articleWordPress Application Passwords: How They Work and When to Turn Them Off
Application passwords give apps their own key to your site, and that key skips the sign-in page. Here is how they work, how to audit them, and when switching them off makes sense.
Read articleGet new articles by email
One short email when a new article is out, plus the WordPress threats worth knowing about. No spam, unsubscribe any time.
Questions
WordPress login security: questions
What is the most important WordPress login security step?
Two-factor sign-in for every administrator, followed by limiting failed attempts. Together they stop almost all password guessing.
Should I change the WordPress login URL?
It cuts the noise from bots that hammer /wp-login.php, which makes real problems easier to spot. It works best alongside two-factor and lockouts, not instead of them.
Is WordPress login security free in Stack Guard?
Yes. The custom sign-in address, lockouts, two-factor and generic login errors are all in Stack Guard Free.