ResultsAiX Login Guard is a free WordPress plugin from the ResultsAiX family by Kevin Fahey. It moves your WordPress sign-in page to a secret address that only you know, so the robots that hammer wp-login.php all day long find nothing there.
Why hide your login?
Every WordPress site in the world signs in at the same two places: yoursite.com/wp-login.php and yoursite.com/wp-admin/. Robots know this, so they visit those addresses around the clock and try password after password. Even when they never get in, every attempt makes your server do work and fills your logs with failed logins. Move the door and the robots knock on a wall instead.
What Login Guard does:
- Your login form answers at an address you choose, for example yoursite.com/my-secret-login/
- wp-login.php shows your site's own "page not found", never a login form and never a hint that one exists
- /wp-admin/ for anyone who is not signed in shows the same "page not found" right where they are, instead of sending them to the login
- If you prefer, both can send visitors to a page of your choice instead
- A Hide my login switch lets you use the normal WordPress login for a while and turn your hidden address back on whenever you like
- Every link WordPress writes to the login page uses your new address automatically: log out, lost password, password reset emails and registration
- Logging out, lost password, password resets, registration and password-protected posts all keep working exactly as before
You can never lock yourself out:
This was the number one design goal. There are four ways back if you ever forget your address, from easiest to last resort. The address is emailed to every administrator. A "forgot where to sign in?" page emails it to you again. It sits on your WordPress Dashboard whenever you are signed in. And one line in wp-config.php switches the disguise off in an emergency. The article Forgot Your Login Address? Every Way Back In walks through each one, step by step.
Nothing on your server is changed:
Login Guard does not rename any files, write rewrite rules or put anything in .htaccess. Deactivate it and your site signs in at wp-login.php again, exactly as it did before.
Already using another hide-login plugin?
Login Guard can take over the address you already use, so nothing changes for you or for anyone else who signs in. See Switching Over From Another Hide-Login Plugin.
One layer, not a lock:
Login Guard hides the door. It is not a firewall and it does not count or block password attempts at your new address. Keep a strong password on every administrator account as well.