I set up a WordPress site for a family member a couple years ago and threw wordfence on there just to see what the ecosystem is like. I get near daily alerts of attempted hacks mostly from Eastern Europe. Most common thing is trying to brute force the login page.
Any improvements to WordPress security are welcome. It's got such a huge target painted on its back. Reminds me of windows in the 90s.
As for what I learned, I would move the admin login page and disable common usernames like admin and anything derived from the site url. Probably stop 90% of attacks just with that.
Any improvements to WordPress security are welcome. It's got such a huge target painted on its back. Reminds me of windows in the 90s.
As for what I learned, I would move the admin login page and disable common usernames like admin and anything derived from the site url. Probably stop 90% of attacks just with that.