Bots Repeatedly Target WordPress Login Pages, Often Using Steady, Credential-List Attacks

Server logs on WordPress sites commonly show steady streams of requests to /wp-login.php and /wp-admin from unfamiliar IP addresses without referrers. The request rate is typically kept slow enough to avoid common rate limits, while usernames tend to cluster around admin, the site's domain name, and common first names, suggesting attacks built from breach dumps rather than random guessing. Because these are raw POST requests rather than browser-driven form submissions, rate-limiting is presented as more effective against this threat than CAPTCHA. The article notes that renaming the login URL is a trade-off, since plugins often link directly to wp-login.php and it does not stop a determined attacker who knows the real address. The piece also includes a simple code snippet site owners can use to log failed login attempts and observe the pattern themselves.