See this link: https://dev.to/lucagrandicelli/the-wordpress-security-handbook-2019-part-2-protect-access-and-sessions-5hl8