Login page at the default address

Why it matters

Bots try common passwords on that address around the clock. With a strong password and two-step verification that is harmless, but it costs server capacity and one weak account is enough.

How Snaglist checks it

This is part of the security check, a separate check next to the crawl, in Studio and Bureau, and only on a site you have verified. Snaglist only looks at what any visitor can see from outside. It never logs in, guesses no passwords and sends no attacks. It checks whether /wp-login.php opens the normal WordPress login page.

Common causes

• WordPress uses this address by default
• No limit on login attempts
• No security plugin

How to fix it

1. Limit the number of login attempts.
2. Switch on two-step verification for every account.
3. If you want, move the login page with a security plugin.
4. Run the security check again to confirm.

How it shows in the report

In the report for your client this appears under the heading "The login page is at the address every bot knows". When everything is in order, the report says: "The login page is not at the default address".