As of 2026, bots make up more of the internet’s traffic than humans.

That doesn’t mean they’re all bad. In fact, some are genuinely useful, helping search engines crawl your website, accessibility tools interpret your content, and monitoring services keep an eye on everything to make sure your site’s working as it should.

But not all bots are helpful. Research from cybersecurity company Imperva found that 40% of all web traffic now comes from bots with bad intentions. These are the ones that attempt to guess login details, pilfer content, spam contact forms, target APIs and generally put extra pressure on websites and servers.

For WordPress websites in particular, there are a few common routes these bots tend to exploit. The good news is that we can shut some of these down by applying some sensible, lightweight protections.

In this article, we’ll share some of the methods and tools we use to help protect the WordPress websites we build from malicious bots.

Limit login attempts

Most automated login attacks are fairly random. Bots will visit a WordPress login page and try to guess their way in using common username and password combinations.

Some are a little more targeted, using details they ‘know’ about you. They might use your business name, names from your team page, public author details, or other information they can find on your website to make more educated guesses.

A simple first line of defence here is to limit the number of login attempts someone can make. This is often known as rate throttling, and it means that if the same username or IP address fails to log in several times, they are temporarily blocked from trying again.

This won’t stop every attack, but it does make brute-force attempts much harder and much less effective.

One quick way to set this up is with a plugin such as Limit Login Attempts Reloaded. As well as limiting repeated login attempts, this also provides a log of failed logins and a block list, so you can permanently block common problem usernames or IP addresses.

2 Factor Authentification

Two-factor authentication, often shortened to 2FA, helps to thwart bots by adding a second step to your login process. So if someone does manage to guess your username and password, they still won’t be able to access your WordPress admin area, because they will need an additional code or approval.

That second step usually comes in the form of a one-time code sent by email or text message, or generated by an authenticator app on your phone. Authenticator apps are often the better option because they don’t rely on email deliverability or mobile signal.

2FA works especially well alongside login attempt limits. Limiting login attempts makes it harder for bots to guess their way in, and 2FA adds another barrier if they do manage to get the right details.

There are plenty of WordPress 2FA plugins available, including WP 2FA and Two Factor. Limit Login Attempts Reloaded, which we mentioned above, also now includes 2FA, which can be useful if you want to manage both protections in one place.

One thing to consider if you do choose email-based 2FA is that it’s worth using an SMTP plugin to help make sure your login codes are delivered reliably.

Block access to feeds and author API

Before a bot can guess your password, it needs to know which username to try.

Sometimes, that information is easier to find than you might expect. By default, WordPress can make certain author information publicly available through author feeds, author archives and the REST API. In some cases, this can expose usernames, author slugs or other details that give bots a useful starting point.

For example, your website’s user REST API end point will live at the URL:

yourdomain.com/wp-json/wp/v2/users/

This feed may return public data about your site’s users, including author names and slugs. On its own, this doesn’t give a bot access to your website. But it can remove one of the barriers by helping them identify valid usernames before they start trying to guess passwords.

That’s why it’s worth reducing the amount of author information your site exposes publicly, especially if your authors are also administrators with usernames based on their real names. Author RSS feeds can be disabled by adding the following to your theme’s functions.php file:

function disable_author_rss_feed() {
    if (is_author() && is_feed()) {
        wp_die(__('No author RSS feeds available.', 'textdomain'));
    }
}
add_action('template_redirect', 'disable_author_rss_feed');

And the REST API user endpoint can be disabled with:

add_filter('rest_endpoints', function($endpoints) {
    if (isset($endpoints['/wp/v2/users'])) {
        unset($endpoints['/wp/v2/users']);
    }
    return $endpoints;
});

Important! – Only update your theme’s functions.php file if you know what you’re doing. A small mistake can break your site, so if you’re unsure what to do, ask your developer to make the change for you.

Turn off Author Archives

Author archives are automatically generated pages in WordPress that group together all the posts written by a particular person.

They can be useful for larger blogs or publications with multiple regular contributors, where readers might want to browse articles by a specific person. But for many small business websites, they don’t add much value – especially if there’s only one main author or all posts are published under an admin account.

From a bot-protection point of view, author archives can make usernames and author slugs easier to discover. That gives bots one less thing to guess when attempting to access your login page.

If your website doesn’t need author archive pages, it’s worth turning them off.

If you’re using the Yoast SEO plugin, you can do this by going to:

Yoast SEO > Settings > Advanced > Author archives

From there, you can disable author archives so those pages are no longer publicly available. This is a small change, but it helps reduce the amount of unnecessary information your website gives away.

Disable XML-rpc

XML-RPC is an older WordPress feature that allows external applications and services to communicate with your website. Historically, it was used for things like posting from the WordPress mobile app, connecting to Jetpack, managing trackbacks and allowing some third-party tools to interact with your site remotely.

The problem is that XML-RPC can also give bots another route to attempt repeated logins or brute-force attacks. If your site doesn’t rely on any tools or plugins that need XML-RPC, it’s usually sensible to disable it.

You can do this with a lightweight plugin such as Phil Erb’s free Disable XML-RPC.

Alternatively, you can add the following line to your theme’s functions.php file:

add_filter( 'xmlrpc_enabled', '__return_false' );

As always, only edit your theme files if you know what you’re doing. If you’re unsure, ask your developer to make the change.

Move your login page

By default, WordPress login pages are usually found at either /wp-admin/ or /wp-login.php.

That makes life easy for bots. They don’t need to search for your login page because they already know where to look – and this means they can go straight to attempting automated username and password combinations.

One simple way to reduce this kind of activity is to move your login page to a less predictable URL.

A lightweight plugin like WPS Hide Login allows you to replace the default WordPress login URL with something unique to your website, such as /my-top-secret-login-page-12ab34cd/.

This doesn’t replace the need for strong usernames, secure passwords, 2FA or login attempt limits, but it can significantly reduce the number of automated login attempts your site receives, simply by removing the obvious route in.

As with any security-related change, make sure the new login URL is stored somewhere safe. You want to hide it from bots, not your own team.

Install a Captcha software on your login page

Another way to protect your login page against malicious attacks is by adding a CAPTCHA challenge.

CAPTCHA tools are designed to help your website tell the difference between a real human user and an automated bot so that it can refuse entry to the latter. You’ve almost certainly seen them before – they’re those little checks that ask you to tick a box, identify objects in an image, or complete another small task before submitting a form.

Adding CAPTCHA to your WordPress site’s login page can help block bots before they even reach the point of trying a username and password.

Google reCAPTCHA is one of the most widely used options and is supported by many of the popular WordPress security and form plugins. If privacy is a priority, however, you might prefer a Big Tech alternative, such as hCAPTCHA, which is often used by website owners looking for a less Google-dependent option.

The main thing to keep in mind, though, is user experience. CAPTCHA can be effective, but it can also frustrate users by adding friction and slowing them down – especially if the challenge is difficult, slow to load, or not very accessible.

For that reason, it’s worth using CAPTCHA thoughtfully. On a login page it can be a useful extra layer of protection. But it shouldn’t be your only defence, and it works best alongside other measures like 2FA.

Use sensible usernames

When setting up a new WordPress site, the suggested default username will generally be ‘admin.’ Make sure to change it, because that will be a bot’s first guess.

We also recommend avoiding other easily guessable usernames, such as your business name or your own name. If your admin username is easy to guess, bots only need to work out the password to gain access to your site. A less predictable username gives them another barrier to get through.

We recommend:

  • Avoiding default usernames such as admin, administrator or your business name.
  • Choosing a username that is not publicly associated with you or your website.
  • Avoiding front-facing email addresses for user accounts.
  • Checking that your user slug or ‘nice name’ does not reveal your username.

It’s worth setting a secure username format from the start, because WordPress usernames can’t be changed from the standard user dashboard. They can be changed directly in the database, but this should only be done by someone who knows what they’re doing.

As a general rule, your public author name should be human-friendly, but your login username should not be easy to guess.

Defending your contact forms

It’s not just your login page that needs protecting – those pesky bots will also hammer your contact forms, given half a chance.

Unprotected contact forms are a magnet for bots that specialise in spam submissions, filling your inbox with junk notifications and clogging up your website’s database (and increasing the amount of energy being used by your site).

There are a few ways you can reduce this.

Akismet is one of the most effective anti-spam tools for WordPress. It checks form submissions against a large spam database and helps filter out suspicious entries before they reach you. It’s a paid tool for commercial use, but for many sites it is well worth the cost.

Another option is to add a honeypot field. This is a hidden field that real users won’t see, but which boots often fill in automatically. If the hidden field is completed, the submission can be flagged as spam or blocked altogether. Honeypots are a great option because they add protection without creating extra hassle for genuine users.

And as mentioned above, you can add CAPTCHA to your contact forms. This adds protection, but it also adds friction and slows down your site, so it’s worth using carefully and with some thought.

The right approach depends on your site, but in most cases, a good anti-spam plugin or honeypot field is enough to keep the bots at bay.

All-in-one WordPress security solutions

If you’d prefer all your security to be handled by a single plugin, there are a few options available to you.

Tools like Wordfence or Kadence Security Basic can help with things like firewall protection, malware scanning, login security, brute-force protection and activity monitoring, and give you one central dashboard for managing the main security settings on your site.

But they aren’t the right fit for every website.

Some all-in-one security plugins can be fairly resource-heavy compared to individual tools, particularly on smaller hosting plans or lower-powered servers. They can also include features you don’t really need, which can add complexity and cost without necessarily adding value.

The alternative is to use a smaller set of lightweight tools that target the particular issues of your site – so you might have one plugin for login attempts, another for 2FA, and another for form spam.

There isn’t one perfect approach. It’s usually a balance between convenience, performance, cost, and the level of protection your website actually needs.

For most small business websites, the best setup is one that gives you sensible protection without slowing the site down or making it harder to use or manage.

Conclusion

Dealing with bots is now a normal part of running a website. Some are useful, but others can put unnecessary pressure on your site, spamming your forms and trying to force their way into your admin area.

The good news is that a few sensible changes can make your WordPress site much harder for malicious bots to exploit.

To recap, we recommend:

  • Limiting login attempts to slow down brute-force attacks.
  • Adding two-factor authentication to protect your admin area.
  • Hiding or restricting public author details where they aren’t needed.
  • Turning off author archives if they don’t add value to your site.
  • Disabling XML-RPC if your website doesn’t rely on it.
  • Moving your login page away from the default WordPress URLs.
  • Adding CAPTCHA thoughtfully, especially on login pages and high-risk forms.
  • Using sensible usernames that aren’t easy to guess.
  • Protecting contact forms with anti-spam tools, honeypot fields or CAPTCHA.
  • Choosing security plugins carefully, with performance as well as protection in mind.

As with most website security, the aim isn’t to make your site impossible to access – it’s to close the obvious gaps, reduce unnecessary noise and make life harder for the bots you don’t want hanging around.

Further reading

beautiful websites,
rooted in good ethics

get in touch