Scale up as you grow — whether you're running one virtual machine or ten thousand.

From GPU-powered inference and Kubernetes to managed databases and storage, get everything you need to build, scale, and deploy intelligent applications.

I have a WordPress site hosted on a DigitalOcean Droplet (Ubuntu 22.04, Nginx, PHP 8.2, MySQL).
Lately I’ve been noticing a lot of failed login attempts in the logs, which look like brute-force attacks on wp-login.php.
So far, I’ve:
Enabled fail2ban
Installed a basic security plugin on WordPress
Changed the default admin username
But the attempts keep coming.
My questions:
Are there additional steps I should take on the server level (firewall rules, SSH configs, rate limiting)?
Is it better to block these at Nginx/iptables level or just rely on plugins?
Any recommended best practices specific to WordPress on DigitalOcean?
cooleb09
IsaacMvd
Leon Junior
hashembarret@gmail.com
JetForMe
24608ead89f046a8abab394f968f2c
Philipp Mayerhofer
enews
Brian Magnosi
jairunet
Nikolas Jakson
Shookshank