WordPress Login Page Fingerprinting

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•6

This rule detects attempts to fingerprint WordPress login pages by monitoring HTTP requests for the 'wp-login.php' URI. It triggers an alert if a source IP makes 5 such requests within 60 seconds, indicating a potential reconnaissance activity against WordPress installations.