Login Security Auditor

What it does

Checks whether two-factor authentication is enforced for admin-level accounts, whether failed login attempts are rate-limited or lockout-protected, and whether author archive URLs, REST API endpoints, or login error messages leak valid usernames to an attacker probing the site.

Install

This skill isn't packaged in an installable registry. It's a plain SKILL.md file you can copy directly. Copy it from the SKILL.md tab and save it at the path for your assistant:

Use it in your AI assistant

Claude Code

.claude/skills/login-security-auditor/ (or ~/.claude/skills/login-security-auditor/ for all projects)

GitHub Copilot (VS Code)

.github/skills/login-security-auditor/

OpenAI Codex

.codex/skills/login-security-auditor/

Cursor

.cursor/skills/login-security-auditor/ (or ~/.cursor/skills/login-security-auditor/ globally)

Compatibility

Any WordPress site; admin access is needed to check user and plugin settings, plus knowledge of any server-level firewall rules already in place.

The complete SKILL.md for this skill:

---
name: login-security-auditor
description: Use when a user wants a login security review, asks if their site is exposed to brute-force attacks, or wants to know if 2FA and rate limiting are properly configured.
---

# Login Security Auditor

## When to use
The user wants to know whether their login page is properly hardened against automated brute-force and username-enumeration attacks, either as a routine check or after noticing suspicious login attempts.

## Procedure
1. Check whether two-factor authentication is enforced (not just available) for all administrator and editor-level accounts.
2. Check for failed-login rate limiting or lockout after repeated attempts, whether via a security plugin or server-level configuration.
3. Test whether author archive URLs (/?author=1) or the REST API users endpoint expose valid usernames without authentication.
4. Check whether login error messages distinguish between "unknown username" and "wrong password", which helps attackers enumerate valid accounts.
5. Note whether the login URL is the unmodified default (/wp-login.php) and whether that's mitigated by other controls (rate limiting, firewall) rather than treated as the only defense.
6. Report findings ranked by risk, with the specific setting or plugin needed to fix each gap.

## Guardrails
- Never attempt actual brute-force or enumeration attempts against a live site as part of testing, verify configuration and settings, not by attacking the login form.
- Do not list actual usernames, discovered credentials, or account details found during the audit in the report, describe the exposure without repeating the sensitive data itself.