What it is

The login page sits at the default address (/wp-login.php or /wp-admin) — the very first URL every automated attack bot tries against every WordPress site on the internet.

How to fix it

Move the login page to a custom, secret address. If you're not sure how, install the WordPress Plugin: it can hide the login natively, without relying on a third-party plugin.

In depth

Your site uses the standard address for logging in as an administrator, usually /wp-login.php, and automated attackers specifically search for that location to test thousands of passwords continuously. Each failed attempt consumes your server's resources, slows down your site, and increases the real risk that someone will gain unauthorized access. The solution is to change that address to a secret URL that only you know, so the automated attacks cannot find where to attempt to break in. Install the free WPS Hide Login plugin from your WordPress dashboard, activate it, and choose a new and complicated address for your login page. From now on, use that secret address whenever you need to log in, and the automated hacking attempts will fail because they won't be able to find the door.