Login Guard is a disguise. To anyone who does not know your secret address, your site looks as if it has no login page at all.
At wp-login.php:
Anyone who goes to yoursite.com/wp-login.php sees your site's own "page not found" page, drawn by your theme, with a genuine not found status. It is the same answer as any other page that does not exist. There is no login form, no redirect that gives the address away and no mention of your secret address. The old wp-register.php address gets the same treatment.
At /wp-admin/ when not signed in:
WordPress normally sends a signed-out visitor from /wp-admin/ to the login page, which would give your address away. Login Guard answers first. The visitor sees your site's own "page not found", drawn by your theme with a genuine not found status, right where they are. There is no redirect to another address. If you chose a page for blocked visitors, they are sent to that page instead.
At your secret address:
The normal WordPress login form. If you are already signed in and just visit your address, you go straight to your Dashboard.
At the help page:
yoursite.com/?login-help shows a small Forgot where to sign in? form. It never shows your login address. It tells search engines not to list it, and it gives exactly the same answer whatever email is typed, so nobody can learn anything from it. While Hide my login is switched off, it says the site signs in at the normal login page and sends nothing. See Forgot Your Login Address? Every Way Back In.
Choosing where blocked visitors go:
On the Settings tab, the box labelled Anyone who tries wp-login.php or /wp-admin/ without signing in sees decides this.
- 404 (the default) shows your site's own "page not found". This is the best disguise, because it looks exactly like any other missing page.
- / sends them to your home page.
- Or type or paste the address of any published page or post on your site to send them there instead. A short address such as contact works, so does a child page such as services/contact, and so does the full web address copied from your browser. Login Guard checks that the page exists and is published before it saves. It refuses an address on another website, and your own login address.
- Leave it empty and it goes back to 404.
If a page you chose is later deleted or unpublished, visitors see your site's "page not found" instead.
What is left alone:
The parts of WordPress that run through the wp-admin folder for your visitors are not touched: the behind-the-scenes requests your site's forms and features make (admin-ajax.php and admin-post.php), scheduled tasks and WP-CLI. Password-protected posts keep working too, because their password form is let through.
Checking it for yourself:
The Dashboard tab has a What is protected section. It shows Hidden or Not hidden for wp-login.php and for /wp-admin/ when signed out, whether the "Forgot where to sign in?" page is On or Off, and how many administrators get the address by email. To see it the way a robot does, open a private browser window and try yoursite.com/wp-login.php.
One exception you control:
If your site shows a login link on purpose, such as a Member Login link in your theme's footer, that link points to your secret address, so anyone who sees the link can see the address. See Working With Your Theme, Other Plugins And Page Caches.