Track 01

🔐 Credential Attacks

Bots don't guess randomly anymore — they replay leaked username/password pairs from other breaches (credential stuffing) or try a handful of common passwords across many accounts (spraying) to dodge lockouts. Flip the breaker to see what stops them.

wp-login.php defense state

NONE2FA + RATE LIMIT

MODE

# No rate limiting, no 2FA, "admin" username
POST /wp-login.php  log=admin  pwd=Summer2026!
POST /wp-login.php  log=admin  pwd=Passw0rd
POST /wp-login.php  log=admin  pwd=Welcome1
POST /wp-login.php  log=admin  pwd=Admin123     -> 200 OK, session issued# fail2ban jail + 2FA required
POST /wp-login.php  log=admin  pwd=Summer2026!  -> 401
POST /wp-login.php  log=admin  pwd=Passw0rd     -> 401
POST /wp-login.php  log=admin  pwd=Welcome1     -> 429 (rate limited)
[fail2ban] IP banned for 3600s after 5 attempts in 300s
-- even a correct password now requires a 2FA code --

Login hardening checklist

Enforce 2FA for all accounts with publish/admin roles.
Rate-limit or fail2ban /wp-login.php and xmlrpc.php.
Disable XML-RPC entirely if remote publishing/Jetpack isn't used.
Block the default admin username; require unique logins.
Check passwords against known-breach lists at creation time.