Khushal Tank

Khushal Login Path Guard is a WordPress security plugin that allows you to change your default login URL and protect your site from common attack vectors. The plugin blocks brute-force attempts, prevents user enumeration, secures sensitive files, and hides WordPress information from potential attackers. All blocked paths display 404 errors (Stealth Mode) instead of redirects, making your site invisible to attackers.
<h4>Features</h4>
Login Protection: 
* Blocks 17+ common brute-force login paths 
* Custom login URL (only you know the path) 
* Shows 404 error instead of redirect (no hints to attackers) 
* Protects /wp-admin, /login, /wp-login.php and more
Advanced Security: 
* Blocks XML-RPC (prevents brute-force via API) 
* Prevents user enumeration via REST API 
* Blocks author page enumeration (?author=1) 
* Protects wp-config.php and sensitive files 
* Blocks direct access to wp-includes PHP files 
* Removes WordPress version information
Security Headers: 
* X-Frame-Options (prevents clickjacking) 
* X-Content-Type-Options (prevents MIME sniffing) 
* X-XSS-Protection (XSS attack protection) 
* Referrer-Policy (privacy protection) 
* Permissions-Policy (feature restriction)
User-Friendly: 
* Easy settings interface 
* One-click URL copy 
* Normal functionality for logged-in users 
* Does not block AJAX requests 
* Clean admin interface
<h4>Security Benefits</h4>
<ol>
<li>Brute Force Protection – 15+ login paths blocked</li>
<li>XML-RPC Disabled – Prevents API-based attacks</li>
<li>User Enumeration Blocked – Hides usernames from attackers</li>
<li>Sensitive Files Protected – wp-config.php, .htaccess secured</li>
<li>Security Headers – Industry-standard HTTP headers</li>
<li>WordPress Hidden – Removes version and generator tags</li>
</ol>
<h4>इस्तेमाल करना बेहद आसान है</h4>
<ol>
<li>Plugin activate करें</li>
<li>Settings > Login Path Security में जाएं</li>
<li>अपना custom login path enter करें</li>
<li>Settings save करें</li>
<li>नया login URL use करें</li>
</ol>

Khushal Login Path Guard

Change your WordPress login URL and protect your site from brute-force attacks. Blocks default login paths with 404 errors.

Mark-k

Stops user name enumeration and other type of user name and email leakages.
Specifically does the following: 
1. When the site is configured to use pretty permalinks, the plugin will prevent 
 the automatic redirect of usrl which include user ID, like example.com/?author=1, to 
 something like example.com/author/admin which will leak the existence of a user 
 named admin which can be used in further brute force attacks. 
 (This is also know as “user enumeration”).
<ol>
<li>
With the REST API restrict user name related information (actual user name 
and user posts page URL) to only admin users.
</li>
<li>
Preventing authentication failure notices on the login page to disclose 
the existence of user names/user emails resulting from displaying different 
messages hen the user is incorrect and when the password is incorrect. Just 
display the same failure message for whatever is the failure reason.
</li>
<li>
Preventing the reset password mechanism from disclosing user names/user emails 
resulting from displaying different messages when a user/email for which a reset 
is requested exist in the DB, and when it does not. Just display the same message 
for both.
</li>
</ol>
Even with the plugin active, if your theme displays author information while linking 
to author pages this can be used for user name leakage. In this case you should 
think about totally decoupling user and author information with plugins like 
https://wordpress.org/plugins/authors-as-taxonomy/
Another thing that the plugin do not do is to handle leakage resulting from the use 
of gravatar, as this requires a replacement of gravatar functionality itself and 
it is much harder to exploit than the other leakages.
And last leakage hole not covered right now, but might be covered in the future, 
is leakage of information via the sign in process. We leave it for later as most 
installs do not allow people to sign in.
Read more on the plugins main page https://calmpress.org/wordpress-plugins/prevent-user-name-and-email-leakage/
<h4>Documentation</h4>
<h4>Contribute</h4>
Pull Requests, bug reports and/or enhancement suggestions are welcome at https://github.com/calmPress/Authors-as-taxonomy

Prevent user name and email leakage

Stops user name enumeration and other type of user name and email leakages.

Khushal Login Path Guard vs Prevent user name and email leakage