Protect Your WordPress Admin

It is becoming more popular for hackers to try to brute force attack your WordPress administrator to gain access to your administrator. Using this method they bombard your admin form with thousands of usernames/password until they find the right combination. WordPress doesn't allow you to choose the default admin username so they already know half of what they need. Fortunately it is easy to add several layers of protection.

#1: Change the admin username

Firstly, you will want to change the default admin username. First you will need to login to cPanel (or your hosts control panel) and go to phpMyAdmin (or any other database editor), then select the WordPress database and browse to the wp_users table. The original user is user id 1, so edit that entry. Pick a username other than "admin". At this point very few hack attempts will work since most just try the default admin username, this involves less coding on their end.

#2: Choose a better admin password

Now you'll need to have an admin password that is difficult to guess. A good password is at least 8 characters (12 is better) and is a mix of all kinds of characters. You can Google around for several different secure password generators.

#3: Install Login LockDown

With Login LockDown you can set a threshold for the number of failed login attempts before a malicious user is blocked. From their WordPress plugin directory description:

Login LockDown records the IP address and timestamp of every failed login attempt. If more than a certain number of attempts are detected within a short period of time from the same IP range, then the login function is disabled for all requests from that range.

Installing Login LockDown is just like any other plugin. Download the .zip file from the plugin directory. Login to WordPress and go to Plugins > New > Upload. After you upload the file you'll want to activate the plugin. You can the setup your rules.

These few, easy steps will exponentially increase the security of your Joomla installation. You will also need a secure WordPress hosting company.