KHALAF Login Access Guard
5/5 (1 ratings) — active installs Updated Sep 24, 2026
General configuration tab with secret slug generator and copy-to-clipboard button.
KHALAF Login Access Guard defends your WordPress website against automated bots, brute-force attacks, and credential stuffing by transforming the standard /wp-login.php path into a private, customizable URL of your choice.
Unlike typical hide-login plugins that simply display a generic 404 error or a blank screen, KHALAF Login Access Guard provides a dedicated visual customizer and a real-time live preview inside your dashboard to design a modern, branded 403 Access Denied page for blocked visitors.
Key Features
- Custom Secret Login URL: Move
/wp-login.phpto any custom slug (e.g./my-secret-door). - Visual Access Denied Customizer: Full control over background gradients/colors, card border radius, shadows, padding, icons, typography, and button styling.
- Interactive Live Preview: Preview your custom 403 Forbidden page in real time directly from the admin settings before publishing.
- Dual-Language & RTL Ready: Native support for Arabic and English with seamless RTL (right-to-left) typography and layout switching.
- XML-RPC Attack Defense: Optional toggle to block automated attacks targeting
xmlrpc.php. - Zero Disruption to Core Actions: Password recovery links with secure reset tokens, logout, privacy confirmations, and protected post actions continue working seamlessly.
- Safe Redirect Option: Option to redirect unauthorized attempts to any custom URL on your domain instead of rendering the denied page.
- One-Click Toggle: Activate or deactivate protection anytime without losing your customized design or settings.
- Cryptographic Slug Generator: Generate secure, randomized login slugs using browser cryptographic randomness with one click.
- Non-Intrusive Admin Notices: Dismissible dashboard reminders compliant with WordPress Guidelines.
Security Notes
- The plugin does not alter the WordPress admin dashboard (
/wp-admin). Once logged in, administrators and authors work normally. - Hiding your login URL provides a strong layer of defense against automated scanning bots, but should be combined with strong passwords and 2FA.
- The redirect option restricts destination targets to the same site domain to eliminate open-redirect vulnerabilities.
- Reserved system slugs (
wp-admin,admin,login,xmlrpc,wp-json, etc.) are blocked from being set as the login slug. - All settings and requests are sanitized, validated, and escaped following WordPress coding standards.