The login page of any content management system is attacked constantly by automated tools. These attacks consume your account's resources even when they fail.
LAYERS THAT WORK
- A strong, unique administrator password, and never a username of "admin", "administrator" or your domain name.
- Two-factor authentication on every administrator account.
- Login attempt limiting, so repeated failures trigger a lockout.
- A changed login URL, which stops most untargeted bot traffic outright.
- Server-level protection with cPanel Directory Privacy in front of the admin folder, so bots never reach the application at all.
- Cloudflare firewall rules that challenge or rate-limit requests to the login path.
ACCOUNT HYGIENE
Give each person their own login. Shared logins make it impossible to tell who did what. Use the lowest role that lets someone do their job. Not everyone needs to be an administrator. Remove accounts when people leave. Review the user list periodically. An administrator account you do not recognise is a compromise, not an oddity.
WATCH FOR
Login notifications from locations you do not recognise, password reset emails you did not request, and settings that change without explanation. All three are early warnings.
