Protecting the control panel.
WHAT TO DO
A strong unique password Two-factor authentication Limit login attempts Remove unused accounts
LIMITING ATTEMPTS
Blocks repeated guessing.
Most security plugins offer it.
CHANGING THE LOGIN ADDRESS
For WordPress, moving the login page away from the default reduces automated noise.
Not real security by itself, and it reduces log volume considerably.
RESTRICTING BY ADDRESS
If you always work from known locations, restricting admin access to those is strong protection.
Keep a fallback route.
WHAT TO AVOID
An administrator account named "admin" Leaving the default username Sharing the administrator account
MONITORING LOGINS
Know when someone logs in, and from where.
Unexpected successful logins are the clearest sign of compromise.
WHAT TO CHECK
Your user list, for accounts you do not recognise.
Attackers frequently create one.
HOW OFTEN
Monthly.
