Website security gets talked about like it is a technical arms race. Firewalls, threat intelligence, monitoring dashboards. Meanwhile a very large share of WordPress compromises come down to one thing: someone logged in as you.
Not exploited a zero-day. Logged in. With a password that was guessable, reused, or sitting in a breach dump from a completely different website.
The fix is unglamorous, takes about fifteen minutes, and works better than most of the expensive stuff.
How your password actually gets taken
There are three routes, and only one of them involves anything you would call hacking.
Brute force. A bot hammers your login page with common combinations. "admin" and "Password123" is still tried thousands of times a day across the web, because it still works often enough to be worth the electricity.
Credential stuffing. This is the big one. Some unrelated service you signed up for years ago got breached, and the email and password pair ended up in a public list. Bots take those lists and try them everywhere, including WordPress logins. If you reused that password, nothing had to be guessed at all.
Your own machine. Malware on a laptop, a password saved in a browser on a shared computer, or an old freelancer's device you have no visibility into.
Notice that in two of the three, the strength of your password is irrelevant. A twenty-character password that you reused is just as compromised as a weak one.
What a good password policy looks like in practice
Forget the old advice about swapping letters for symbols. Length beats complexity, and uniqueness beats both.
- Unique per site, always. No exceptions, including "just the staging site".
- Long. Sixteen characters or more. A generated string from a password manager is ideal because you are never going to type it anyway.
- Never the username "admin". It halves the work for an attacker. If you have an account called admin, create a new administrator under a different name, then delete the old one.
- Use a password manager. 1Password, Bitwarden, whatever. The point is that unique passwords are only realistic if you are not remembering them.
- Never share a login. If three people use one account, you cannot revoke access for one of them, and you cannot tell who did what.
The fix: open your WordPress user list right now and check two things. Is there an account named admin, and is there anyone on that list who no longer works with you? Both are five-minute problems that stay dangerous for years.
Two-factor is the part that actually changes the outcome
Everything above reduces the chance your password gets taken. Two-factor authentication changes what happens when it does anyway.
With 2FA switched on, the password becomes one of two things an attacker needs. The second is a code from an app on your phone that changes every thirty seconds. A bot working through a leaked credential list hits that wall and moves on, because it has no way over it.
That is the whole idea. You are not trying to be uncrackable. You are trying to make the automated attack fail, and automated attacks are essentially all of them.
Not all second factors are equal
- Authenticator app (Google Authenticator, Authy, Duo). The right default for almost everyone. Free, offline, hard to intercept.
- Hardware key (YubiKey and similar). The strongest option, genuinely resistant to phishing. Worth it if the site is critical.
- Email codes. Better than nothing, but if your email is compromised the second factor is compromised too.
- SMS. The weakest form, because phone numbers can be transferred away from you by someone who talks a carrier into it. Still far better than no second factor at all.
One practical warning. Save your backup codes somewhere outside your phone before you need them. Locking yourself out of your own site because you replaced your handset is an avoidable and thoroughly annoying afternoon.
The bits people forget
Your WordPress dashboard is not the only door. Protect the hosting control panel, the domain registrar account, the email account that receives password resets, and any FTP or database access. An attacker who owns your registrar owns your domain, and no amount of WordPress hardening helps at that point.
Also worth doing: limit login attempts so brute-force bots get blocked after a handful of failures rather than being allowed to try forever.
Getting it set up and keeping it that way
This is the kind of task that is easy to do and easy to let slide. New contractor gets an admin account for one job. Someone turns off 2FA because it was annoying during a redesign. Six months later the door is open again.
On Up Speed, two-factor login on your admin accounts is part of the Professional plan, alongside iThemes hardening for brute-force protection and the Wordfence firewall. It gets configured properly and it stays configured, and user access is reviewed as part of ongoing care rather than whenever someone happens to think of it.
No setup makes an account impossible to compromise. But turning a stolen password into a dead end removes the most common way sites are lost, and that is a very good return on fifteen minutes.