Recognise login pressure without locking out the owner.
Login and XML-RPC endpoints attract automated requests. The goal is to distinguish hostile probing from the legitimate integrations and administrators that use these routes.
WordPress plugin · Private demo · Guided trial · Proposed $500 lifetime licence
wp-login.php is high-value traffic.
A bot may try your WordPress login thousands of times, guessing passwords or testing accounts. That uses server resources and raises the chance of an unwanted login. BotExorcist records repeated attempts and helps enforce rules against the sources.
Questions about this workflow? See a private walkthrough.
BOTEXORCIST / ACCESS & CRAWLER POLICY
Recognise login pressure without locking out the owner
wp-login.php / watch
xmlrpc.php / check dependencies
Admin access / preserve
XML-RPC has legitimate uses.
Some legitimate apps still use the WordPress XML-RPC connection. A blanket block can break those apps. Our pros check which tools you use before choosing what to restrict.
Prevent admin lockouts.
A security plugin that locks its owner out is a problem of its own. We test your login and trusted access during setup and keep a recovery route ready if something is blocked by mistake.
Explore more BotExorcist features.
An address is a clue. A network can be the pattern. Book a demo. We handle the technical side.
See BotExorcist on your own WordPress site. Our pros handle setup and calibration, then you decide if it earns a permanent place.