Login Lockout Policy SOP

Login Lockout Policy SOP
Configure on every site that has a wp-admin login.

— Step 1: Set the threshold. 5 failed attempts, then a 20-minute lockout. Escalate repeat offenders to 24 hours.
— Step 2: Lock by username AND IP. Attackers rotate IPs, so per-account counting matters more.
— Step 3: Mask the error. Never reveal whether the username or the password was wrong.
— Step 4: Rename or protect wp-login.php at the server level to cut bot volume before it hits PHP.
— Step 5: Whitelist your office and VPN egress IPs so you don't lock yourself out.
— Step 6: Alert on 50+ lockouts in an hour — that's an active campaign, not noise.

Run this every time.