How To Block IP Addresses From WordPress Login: A Practical Security Guide

How to Block IP Addresses from WordPress Login

If your WordPress site is seeing repeated login attempts, blocking suspicious IP addresses can be one of the fastest ways to reduce risk.

This guide explains practical methods for restricting login access and shows where IP blocking works best, where it falls short, and how to combine it with stronger protections.

Why IP Blocking Matters for WordPress Security

WordPress sites are common targets for brute-force attacks, credential stuffing, and automated bots.

These attacks often come from a small set of IP addresses, entire IP ranges, or rotating networks that hammer the login page, XML-RPC endpoint, or password reset forms.

Blocking an IP address does not replace strong passwords, two-factor authentication, or rate limiting, but it can quickly stop repeated abuse from known sources.

It is especially useful when you identify a single attacker, a suspicious hosting provider, or a country or region you do not serve.

Stops repeated login attempts from known bad actors
Reduces server load caused by bots and brute-force scripts
Can protect wp-login.php and related authentication endpoints
Works well as part of a layered WordPress security plan

Before You Block: Identify the Right IP Addresses

Block only after confirming the traffic is truly suspicious.

Blocking the wrong IP can lock out real users, shared office networks, search engine crawlers, or your own VPN connection.

Start by reviewing logs and security alerts.

Look for patterns such as repeated failed logins, requests at unusual times, or multiple usernames targeted from the same address.

Many security plugins and host dashboards show this information clearly.

Common places to check

WordPress security plugin logs
Web server access logs
Hosting control panels such as cPanel or Plesk
Cloud firewall dashboards such as Cloudflare or Sucuri

If you manage a business site, confirm the IP is not used by a trusted contractor, remote employee, or managed service provider before blocking it.

How to Block IP Addresses from WordPress Login with a Security Plugin

For most site owners, a security plugin is the simplest way to block suspicious IP addresses from login activity.

Popular tools such as Wordfence, Sucuri Security, iThemes Security, and All In One WP Security offer firewall, login protection, and blocklist features.

In Wordfence, for example, you can view live traffic, identify repeated login attempts, and add offending IP addresses to the blocklist.

Other plugins offer similar options through firewall rules, country blocking, or login lockdown settings.

Typical plugin workflow

Open the plugin’s security or firewall dashboard.
Review login attempts and failed authentication records.
Select the suspicious IP address or range.
Add it to the blocklist or denylist.
Save the rule and verify the block is active.

Plugin-based blocking is ideal if you want a user-friendly interface, logs, and extra features like brute-force protection, two-factor authentication, and alerts.

It is also easier to manage when multiple administrators are involved.

How to Block IP Addresses from WordPress Login Using .htaccess

If your site runs on Apache, you can block specific IP addresses at the server level with the .htaccess file.

This method is powerful because it can deny access before WordPress loads, reducing overhead and helping protect the login page directly.

Always back up your .htaccess file before editing it.

A small syntax error can take your site offline, so changes should be made carefully and tested immediately.

Example .htaccess rules

<Files wp-login.php>
Order Deny,Allow
Deny from 123.456.789.000
Allow from all
</Files>

For modern Apache configurations, your host may use different syntax or support access control through server config instead of .htaccess.

If you are unsure, ask your host for the recommended method.

This approach works well when you want to block access to wp-login.php specifically, but it will not stop every form of attack unless you also protect XML-RPC and admin endpoints.

How to Block IP Addresses from WordPress Login in Nginx

Sites running on Nginx usually handle blocking in the server configuration.

This is common on managed VPS and cloud hosting environments.

Like Apache rules, Nginx blocks operate before WordPress processes the request.

Example Nginx rule

location = /wp-login.php {
    deny 123.456.789.000;
    allow all;
}

Nginx changes normally require a configuration reload.

If you do not have server access, your hosting provider can often add the rule for you.

Server-level blocking is especially useful for high-traffic sites, eCommerce stores, and membership sites where performance matters and login abuse needs to be stopped early.

Using a Web Application Firewall to Block Login Attacks

A Web Application Firewall, or WAF, is one of the most effective ways to block bad IP addresses and automated login attacks.

Services such as Cloudflare, Sucuri Firewall, and Akamai sit in front of your site and filter traffic before it reaches WordPress.

With a WAF, you can block individual IP addresses, allow trusted IPs, challenge suspicious visitors with CAPTCHA, and create rules based on behavior, geography, or request patterns.

This is particularly helpful when attackers use rotating proxies or distributed botnets.

Blocks threats before they reach your hosting account
Supports IP, country, and ASN-based filtering
Can enforce rate limiting and bot challenges
Helps protect multiple WordPress sites at once

Should You Block the Entire Login Page or Just Specific IPs?

Blocking individual IP addresses is the most precise approach, but it is not always enough.

In some cases, you may want broader controls such as country blocking, login throttling, or restricting access to the login page by VPN or office network.

For internal sites, an allowlist can be safer than a blocklist.

That means only approved IP addresses can reach the login page, which is useful for intranets, agency workflows, and admin-only portals.

When to use a blocklist

You have identified repeated attacks from known IPs
Traffic is coming from a small set of suspicious addresses
You need a quick response to active abuse

When to use an allowlist

Only a few trusted people should log in
The site is not public-facing for admin use
You want the strongest possible login restriction

Best Practices to Avoid Locking Yourself Out

Before saving any rule, make sure you know your current IP address and have an alternate way back into the site.

Whitelists your own IP before adding restrictive blocks
Test the rule in a second browser or network if possible
Keep hosting support contact information available
Document every IP block and why it was added

For teams with changing office IPs or remote workers, static allowlists may become difficult to maintain.

In those cases, a VPN or identity-based access method is often more reliable than manual IP management.

How to Strengthen Login Security Beyond IP Blocking

Blocking IP addresses from WordPress login is only one layer of defense.

The best results come from combining it with other controls that reduce attack success even when attackers change addresses.

Enable two-factor authentication for all admin accounts
Use long, unique passwords stored in a password manager
Limit login attempts with a plugin or WAF
Disable or protect XML-RPC if you do not use it

Rename or hide the login URL only if your workflow supports it
Keep WordPress core, themes, and plugins updated

Also review account permissions regularly.

Removing unnecessary administrator accounts is often more effective than trying to block every malicious login source individually.

When IP Blocking Is Not Enough

Some attackers use botnets, mobile networks, or residential proxies that constantly change IPs.

In those cases, IP blocking alone will not stop the threat.

You may need behavioral detection, CAPTCHA challenges, stricter rate limiting, or authentication hardening at the application layer.

If login abuse continues despite blocks, check whether the attacker is targeting a specific username, exploiting XML-RPC, or attempting password resets.

Adjust your response based on the pattern rather than relying on a single rule.

For most WordPress administrators, the smartest approach is to block confirmed bad IPs quickly, then layer in a WAF, login throttling, and two-factor authentication for lasting protection.

Table of Contents