FALKEN'S MAZE / CHECKS / LOGIN PROTECTION

Login protection

What Joshua checks

Uses the Plugin Recon WordPress plugin's list of plugins to check that a public wp-login.php has a plugin limiting login attempts or adding two-factor sign-in.

Why it matters

WordPress never slows down failed logins, so an open login page lets bots guess passwords all day.

How to fix it

Install a plugin that limits login attempts or adds two-factor sign-in (Limit Login Attempts Reloaded, Two-Factor, Wordfence), or restrict wp-login.php by IP. If your host or firewall already does this, you can ignore it.

In the Maze Score

Worth

5 points (half for a warning)

Severity

Medium

Runs on

Plans with the Plugin Recon add-on

Related checks

• WordPress core versionPlugin Recon
• Plugin versionsPlugin Recon
• User enumerationPlugin Recon
• Theme versionsPlugin Recon
• XML-RPCPlugin Recon
• Known vulnerabilitiesPlugin Recon
• Exposed filesPlugin Recon
• PHP and WordPress settingsPlugin Recon
• Abandoned pluginsPlugin Recon