Hardening wp-login: 2FA, Rate Limits, and CAPTCHAs That Work
wp-login.php is the single most attacked URL on the open web. Here is the layered defense, strong authentication, lockouts, bot challenges, and a plan for what to do when credential stuffing shows up in your logs.