A lightweight plugin that lets you change and protect your WordPress login URL while tracking failed login attempts and customizing the login page.

Code and Core

<p>Admin Login Guard & Branding allows you to change your WordPress login URL to a custom slug, preventing brute force attacks and providing enhanced security by hiding the default <code>wp-login.php</code>.</p>
<p>It goes beyond just renaming the login URL; it includes robust features to limit login attempts, track failed logins, and fully customize the visual appearance of your login page to match your brand.</p>
<p>It supports WordPress Multisite networks, allowing you to control login settings across your entire network.</p>
<h4>Key Features</h4>
<ul>
<li><strong>Custom Login Slug</strong>: Change <code>wp-login.php</code> to something unique (e.g., <code>/my-secret-login</code>).</li>
<li><strong>Access Control</strong>: Automatically blocks access to <code>wp-login.php</code> and <code>wp-signup.php</code> for non-logged-in users.</li>
<li><strong>Limit Login Attempts</strong>: Set maximum failed login attempts and lockout duration to prevent brute-force attacks.</li>
<li><strong>Login History</strong>: Keep a detailed log of failed login attempts, including IP address, username, time, and user agent.</li>
<li><strong>CSV Export</strong>: Download your login failure history for analysis.</li>
<li><strong>Custom Redirection</strong>: Choose a custom page or 404 page to redirect unauthorized users to.</li>
<li><strong>Visual Customization</strong>:
<ul>
<li>Upload a custom logo.</li>
<li>Set custom logo width, height, title, and link.</li>
<li>Set a background image or color.</li>
<li>Customize button colors, form borders, and label colors.</li>
<li>Customize “Lost Password” and “Back to Home” link colors.</li>
<li>Option to hide the “Back to Home” link.</li>
</ul>
</li>
</ul>
<h3>Privacy & Data Collection</h3>
<p>This plugin respects your privacy. Both the diagnostic tracking and deactivation feedback features are <strong>100% optional</strong>.</p>
<h4>Telemetry & Diagnostics (Opt-in Only)</h4>
<p>Upon activation, you will be invited to share anonymous site diagnostics. This is <strong>strictly opt-in</strong> and can be disabled at any time from the ‘Privacy’ tab in settings. If you agree, we collect:</p>
<ul>
<li>WordPress, PHP, and Plugin version numbers.</li>
<li>Theme name/version and locale.</li>
<li>Multisite status and a hashed site identifier.</li>
<li><strong>No personal data, user information, or site content is collected.</strong></li>
</ul>
<h4>Deactivation Feedback</h4>
<p>If you decide to deactivate the plugin, a feedback modal will appear. Providing feedback is <strong>entirely optional</strong>—you can click “Skip & Deactivate” to deactivate the plugin immediately without sharing any data. You may optionally share your name and email address if you wish to be contacted for support.</p>
<h4>Data Security</h4>
<p>All collected data is encrypted using <strong>AES-256-CBC</strong> before being transmitted to our secure receiver server.</p>
<h3>External services</h3>
<p>This plugin connects to external APIs operated by Code and Core to support optional telemetry diagnostics and optional deactivation feedback. Both services are entirely opt-in / optional.</p>
<h4>1. Telemetry / Diagnostics receiver</h4>
<p>This plugin connects to an API to send anonymous site-health data, it’s needed to help prioritize compatibility updates.<br />
It sends the Site URL, plugin name & version, PHP version, WordPress version, active theme name & version, site language, multisite status, and a Unix timestamp every time the plugin is activated, deactivated, or updated, ONLY if the administrator has explicitly opted in.<br />
This service is provided by “Code and Core”: <a href="https://codeandcore.com/privacy-policy/" rel="nofollow ugc">privacy policy</a>.</p>
<h4>2. Deactivation feedback receiver</h4>
<p>This plugin connects to an API to receive voluntary feedback, it’s needed when a site administrator chooses to share a reason for deactivating the plugin.<br />
It sends Deactivation reason, optional details, Site URL, plugin name & version, PHP version, WordPress version, active theme name & version, site language, multisite status, and a timestamp ONLY when the administrator clicks “Submit Feedback” in the deactivation modal. Name and email are sent only if the contact checkbox is checked.<br />
This service is provided by “Code and Core”: <a href="https://codeandcore.com/privacy-policy/" rel="nofollow ugc">privacy policy</a>.</p>
<p>All data transmitted to endpoints on <code>wordpress-plugins.pro</code> is encrypted with AES-256-CBC before sending.</p>
<h3>Credits</h3>
<ul>
<li>This plugin uses <a href="https://datatables.net/" rel="nofollow ugc">DataTables</a> for displaying login history.</li>
</ul>


Alternatives to Admin Login Guard & Branding

Top alternatives