Admin login page is publicly reachable

What does this mean?

Your WordPress login page is reachable at the default address, which means it's constantly targeted by automated bots trying common username/password combinations (a "brute-force" attack). Enough attempts against a weak password can eventually succeed.

What are the potential impacts?

• An exposed, default-location admin login is a constant target for automated bots running credential-stuffing and brute-force attacks around the clock, not just when someone specifically targets you.
• A successful login gives an attacker full control of your site — enough to inject malware, deface content, steal customer data, or use your server to attack other sites.
• Even unsuccessful attack attempts can consume server resources and occasionally trigger hosting-provider suspensions for "abusive traffic."