Block wp-login.php and use a secret login URL

Block wp-login prevents automated requests from reaching the default WordPress login endpoint. It creates a secret login URL for authorised users and adds Apache rewrite rules that return a 403 Forbidden response for direct requests to wp-login.php.

Because blocked requests are rejected before WordPress loads, the plugin can reduce the server resources consumed by bots repeatedly targeting wp-login.php.

Features include:

Choose your own secret login slug or generate a random one.
Block direct access to the default wp-login.php endpoint with a 403 response.
Continue to support password resets, registration and WordPress administration email verification through the secret login URL.
Rebuild the secret login file after a WordPress core update.
Optionally email administrators when the login URL changes.
Optionally notify the site owner when an administrator signs in from an IP address that is not on the known-IP list.

Important compatibility information

Block wp-login requires an Apache web server with mod_rewrite and a writable .htaccess file in the WordPress root directory. It is not compatible with Nginx or servers that do not honour .htaccess rules.

Hiding the default login endpoint reduces automated login traffic, but it is not a replacement for strong passwords, two-factor authentication, updates, backups or other appropriate security controls.