No Login Page to Guess: Your Site Without wp-admin
Bots try passwords on wp-login.php and xmlrpc.php on every WordPress site they find. A static site has neither address to try.
Every WordPress site keeps its login page at the same address, /wp-login.php, and /wp-admin sends you there. That suits the people who run the site. It also tells everyone else where to try passwords.
They try all the time. In the first half of 2021, Wordfence blocked more than 86 billion password attack attempts on the WordPress sites it protects. 40.4% went at the standard login page and 37.7% at XML-RPC, an older interface that also takes a username and password (WP Tavern on the Wordfence and WPScan report).
XML-RPC is the worse of the two. In 2015 Sucuri found attackers using one of its features, system.multicall, to try hundreds of passwords in a single request. A tool that counts login attempts by request saw one (Sucuri).
The usual answer is more plugins: limit login attempts, rename the login page, add a second factor, switch off XML-RPC. They help, and each is more code to keep updated on the server it protects.
Where a static site is edited
Nowhere on the site itself. It has no login page, no admin area and no XML-RPC, so a bot that asks for /wp-login.php gets a “not found” page and nothing more.
You change a static site by changing its files in your Git repository on GitHub or GitLab and pushing. That account is the one to protect, and both services offer two-factor sign-in and SSH keys. Git also keeps a record of every change and who made it, so an edit you didn’t expect shows up in the history and can be undone in one step.
If several people edit the site, each gets their own GitHub or GitLab account with access to the repository. Nobody shares a password, and when someone leaves you remove their access and nothing else changes.
The bots keep asking
They will go on asking for /wp-login.php on your domain for years, because they ask every domain. On a static site each request gets a small “not found” page and costs you nothing.
If you’re moving from WordPress, turn on two-factor sign-in for your GitHub or GitLab account before anything else. Yesterday’s post looked at why most WordPress vulnerabilities are in plugins.
Ready to Deploy?
Join Jamstack developers across the UK hosting their static sites with privacy and performance built in. Hosting is free for good, no credit card needed, with Plus features when you want them.
