Locking Down the Login Page

Why this one page

Automated attacks are opportunistic and cheap, and a login form is the cheapest thing to attack: it accepts guesses, tells you when one is right, and can be tried indefinitely.

Everything else on a small site is comparatively hard, which is why the login page absorbs the overwhelming majority of hostile traffic.

Which makes it the place where a small amount of work removes a large proportion of the risk.

Four measures cover it, and they are worth understanding separately because each stops a different thing.

Rate limiting stops guessing

The single most effective measure and the first to apply.

It blocks an address after a small number of failed attempts, for a period, which turns unlimited guessing into a handful of tries.

That defeats the entire class of attack that depends on volume, which is most of what arrives.

Set it to something like five attempts and a lockout measured in minutes rather than seconds, and increase the lockout for repeat offenders where the tool supports it.

Most platforms have this built in or available as a plugin, and many hosts provide it at their level, which is better since it blocks before the request reaches your site.

Ask your host whether they already do this before installing anything.

Two-step verification stops a correct password

Which rate limiting does not.

A password obtained from a leak elsewhere, or from a phishing message, is not a guess and arrives correct on the first attempt.

Rate limiting never triggers, and the attempt succeeds.

Two-step verification is the only measure on this list that stops that, which is why it belongs on every administrator account regardless of what else is in place.

Apply it to administrators first, since those are the accounts worth taking, and to everybody else if the platform makes it easy.

Keep the recovery codes somewhere the business can reach them and not on the same device as the authenticator.

Restricting access stops everything

• Allow-listing addresses, if yours are fixed.
• Requiring a second password at the server level.
• Blocking whole countries you never work from.
• Disabling the page outside working hours.

These are the strongest options and the least practical for most small businesses, since a fixed address is unusual and a locked-out owner on a Sunday is a real cost. Consider them where the site is business-critical and the people who log in are few.

Close the other doors

The part people miss, since the login form is not always the only way in.

Several platforms have secondary interfaces that accept credentials: interfaces intended for apps, publishing tools, or remote management.

Those frequently bypass whatever you have applied to the login page, which is how a site with rate limiting still shows successful unauthorised access.

Disable anything you do not use, and where you do use it, generate a limited credential for that purpose rather than using the main account.

Ask whoever maintains the site which secondary interfaces are enabled, since this is not visible from the front end and is not something an owner would find.

A worked example

A site was receiving several thousand login attempts a month and the owner had installed a plugin that reported them.

They enabled rate limiting, which cut the successful reach of those attempts to nothing, and the volume continued unchanged for weeks.

Then the reporting showed authentication attempts arriving through a secondary interface that the rate limiting did not cover.

Disabling that interface, which the business had never used, stopped it entirely.

They added two-step verification on the two administrator accounts, which took about ten minutes.

The whole exercise was an afternoon, and the attempts fell to a background level within a fortnight.

What not to bother with

Since effort spent here should go where it works.

Moving the login page reduces noise and stops nothing that looks properly, so treat it as log hygiene rather than security.

Blocking individual addresses manually is endless, since they change constantly, and is what rate limiting automates.

Elaborate security plugins with many features tend to slow the site and duplicate what the host already provides.

And puzzles or challenges on the login page frustrate the people who are meant to be using it while stopping only the crudest attempts.

Rate limiting, two-step verification, and closing the secondary interfaces is most of the available benefit.

Check it worked

Because a measure that is not actually running is worse than none, since you believe you are covered.

Test the rate limiting yourself by entering a wrong password repeatedly and confirming you get locked out.

Confirm two-step verification is required by signing in from a browser you have not used.

Check the log a fortnight later and see whether the pattern changed, which tells you whether what you applied is covering the route being used.

Where the volume is unchanged and unaffected, something is reaching the site by a path you have not addressed.

Two-step on the hosting account too

Worth stating because attention concentrates on the site and the layer beneath it is frequently unprotected.

Somebody with the hosting control panel does not need your site login at all, since they can edit files, reset passwords, and read the database directly.

The same applies to the registrar, where access allows the domain itself to be redirected or moved.

Both offer two-step verification and both are typically set up once, years ago, with whatever password was convenient.

Hardening the login page while those remain open is locking the front door of a building with an unlocked service entrance.

The counter-case

This can be over-invested in.

A site with strong distinct passwords and two-step verification is already in good shape, and the rest is defence in depth rather than necessity.

Aggressive restrictions also create a real operational risk, and a business locked out of its own site at an inconvenient moment has paid for the protection.

The larger risks for most small sites remain outdated software and reused passwords, which no amount of login hardening addresses.

Do the four things, keep them simple, and spend the remaining attention on updates and backups.

The afternoon

1. Ask your host what they already provide.
2. Enable rate limiting and test it yourself.
3. Turn on two-step verification for administrators.
4. Store the recovery codes where the business can reach them.
5. Disable secondary interfaces you do not use.
6. Consider restricting access if your addresses are fixed.
7. Recheck the log in a fortnight.

Step five is the one that explains why hardening sometimes appears not to work, since an interface bypassing the login form makes everything applied to that form irrelevant.

The account behind the form is covered in the admin account called admin.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.