I’m a regular advocate of simple solutions to WordPress solution – enforcing 2FA, applying login limits, etc., rather than moving your login screen or various other practices which have dubious advantages.
Today I have another idea to share, which was suggested by a WordPress VIP customer, and it’s such a simple but effective idea – prevent login by email address.
Why? Because most brute force attempts are made via email, as they’re the login component that are often found in leaked data breaches. Instead, you must use your username to login.
The script was written by a colleague of mine, Cody Crady, and then I’ve refined it to make sure it meets various WordPress coding standard requirements. Just add it your functions.php file and hange text-domain to, well, your text domain for the error translation to work.
Longer term, I’m looking at converting this into a plugin as, although this script works, it’s a bit rough-and-ready (the login screen still prompts for either a username or email address). I also have some further ideas for security improvements too, which I may roll into the same solution.
Share this post on social media.
Leave a Reply