The page attacked most on any site.
WHY IT MATTERS
Login pages are attacked continuously by automated tools. Each attempt consumes your resources even when it fails.
THE LAYERS
- Strong unique passwords, and no username of admin or administrator.
- Two-factor authentication on every administrative account.
- Login attempt limiting, with lockouts after repeated failures.
- A changed login URL, which stops most untargeted bots outright.
- cPanel Directory Privacy in front of the admin directory, which stops them before the application runs.
- Cloudflare rules challenging or rate-limiting requests to the login path.
DIRECTORY PRIVACY
The strongest of these on shared hosting. It adds a server-level password prompt, so bots never reach your application at all. It also removes the resource cost of the attacks.
Note it adds a second login for legitimate users, which is a minor inconvenience for a significant gain.
WATCH FOR
Login notifications from unfamiliar locations Password reset emails you did not request Settings changing without explanation
All three are early warnings.
