Treat suspicious WordPress login attempts as evidence, not background noise. Start by checking who tried to log in, which username they used, how often they failed, and whether the IP keeps coming back after being blocked. Credential attacks are not rare; Verizon’s 2024 DBIR says stolen credentials appeared in 77% of basic web application attacks [source: Verizon].
TLDR: Use Login Lockdown to record failed WordPress login attempts, lock out repeat offenders, and review strange IPs before they become a real problem. For example, if one IP tries “admin” 38 times in 12 minutes, you likely have an automated bot, not a confused human. A quick review of usernames, timing, and repeat lockouts can help you decide whether to block the IP, change passwords, or tighten login rules. Expect a few false alarms, but repeated attempts against old usernames deserve attention.
Start With the Login Lockdown Logs
The easiest first step is to install and use Login Lockdown. The plugin tracks failed login attempts and can lock out IP addresses after too many failures. That gives you a clean starting point instead of guessing from vague server stats.
After setup, open the plugin’s settings and review recent lockouts. Focus on three things:
- IP address: Is the same address failing again and again?
- Username: Are they trying “admin,” old staff names, or real accounts?
- Timing: Are attempts spaced like a human, or fired every few seconds?
If the same IP hits the login page 20, 50, or 100 times, treat it as hostile. If many IPs try the same username, that may be a botnet. Annoyingly, some tools make you click through too many screens to find this. Login Lockdown keeps the signal easier to read.
Check the Username Being Attacked
The username matters as much as the IP. If attackers keep trying admin, your site is getting sprayed by a basic bot. If they try a real editor name, author name, or email address, they may have scraped your site or found data from another source.
Here is what to do:
- If “admin” exists: Create a new administrator account with a unique username, then delete the old admin user and assign its content to the new account.
- If real usernames are being used: Ask those users to change passwords right away.
- If email addresses are being tried: Check whether those emails were exposed elsewhere.
Honestly, it feels like a small thing until you see 60 login attempts using the exact name of a former employee. That is when the logs stop being boring.
Look Up the IP, But Do Not Overreact
Copy the unknown IP address and check its location and reputation using a trusted IP lookup service. You are looking for patterns, not perfect truth. IP location data can be wrong. VPNs and proxies can hide the real source.
Ask these questions:
- Does the IP come from a country where you have no customers or staff?
- Is it linked to a data center rather than a home internet provider?
- Has it returned after being locked out?
- Are nearby IPs showing the same behavior?
If one IP from a data center fails 45 times, block it. If 300 different IPs each fail twice, blocking one by one will waste your afternoon. In that case, tighten your lockout rules instead.
Set Sensible Lockout Rules
Login Lockdown lets you control how failed attempts are handled. A good starting point is simple:
- Maximum login retries: 3 to 5 failed attempts
- Retry time period: 5 to 15 minutes
- Lockout length: 30 to 60 minutes
- Repeat offender action: Longer lockout or manual block
Too strict can annoy real users. Too loose helps bots. If your site has only a few admins, use stricter rules. If you run a membership site, leave a little more room for mistakes.
For more control, review the paid features at WP Login Lockdown. It is useful when you need stronger protection, better control over lockouts, or a cleaner way to manage repeated attacks.
Compare Plugin Logs With Hosting Logs
Plugin logs tell you what happened at the WordPress login level. Hosting logs show the wider picture. Check access logs in your hosting panel and search for requests to:
/wp-login.php/xmlrpc.php/wp-admin/
If the same IP also hits xmlrpc.php hundreds of times, that is not a normal login mistake. It is automation. Block it at the server or firewall level if your host allows that.
Decide What Action to Take
Use severity to decide. A single failed login from an unknown IP is not panic time. Ten failures against “admin” is suspicious. Fifty failures against a real username is urgent.
- Low risk: One or two failures. Watch only.
- Medium risk: Repeated failures from one IP. Let Login Lockdown block it.
- High risk: Real usernames, many IPs, or repeat attacks. Reset passwords and review admin users.
Also remove unused administrator accounts. Turn off author archives if they expose usernames. Use strong passwords. Review login activity weekly if your site gets regular traffic.
Keep a Simple Investigation Record
Write down the date, IP, username tried, number of failures, and action taken. A small spreadsheet is enough. This helps you spot repeat behavior over time.
Suspicious WordPress login attempts are common, but they should not be ignored. With Login Lockdown, you can slow attackers down, understand what they are trying, and react before a guessed password turns into a hacked site.
