SatoruHatano

Mamotte! Login URL Changer protects your WordPress site by replacing the default <code>/wp-login.php</code> with a custom URL of your choice. Unauthorized users who don’t know the secret URL will receive a 404 error or be redirected to the top page — keeping bots and brute-force attacks away from your login screen.
<h4>Key Features</h4>
<ul>
<li>Custom login URL — Set any slug (e.g. <code>mylogin</code> or <code>2024/secret</code>) as your new login endpoint.</li>
<li>Flexible block behavior — Choose to show a 404 page or redirect to the site top when the original URL is accessed.</li>
<li>IP whitelist — Restrict login access to specific IP addresses. Editors can register their own personal IP from the dashboard.</li>
<li>Trusted device management — Skip repeated authentication challenges on devices you trust (via OTP cookie).</li>
<li>Login question (story quiz) — Generate a unique story-based CAPTCHA from your own word lists (characters, places, drinks, foods, activities, items, animals). Makes login both secure and fun.</li>
<li>Login screen designer — Customize the login page’s background color, button color, logo, form style, and more — all with a live preview.</li>
<li>Contact form tab — Configure a built-in inquiry form displayed on the login screen.</li>
<li>Access log — View a history of login attempts with IP addresses, results, and timestamps.</li>
<li>Editor-safe settings — Editors (non-administrators) can update only their own IP entry via Ajax; all other settings require administrator privileges.</li>
<li>Clean uninstall — All plugin data is removed from the database on deletion.</li>
</ul>
<h4>Use Cases</h4>
<ul>
<li>Block automated brute-force attacks without a heavy security plugin.</li>
<li>Add a lightweight second layer of authentication for small teams.</li>
<li>Customize the login experience to match your brand.</li>
</ul>

Mamotte! Login URL Changer

Change your WordPress login URL to a custom slug, with optional IP whitelist and trusted device management for enhanced security.

Jonas Hjalmarsson

Version 1.5.0 is a recommended security update for all existing users. It blocks JavaScript injection on the Under Construction page, hardens the bypass cookie (Secure/HttpOnly/SameSite), tightens IP-whitelist validation, and fixes silent breakage with WP-CLI, cron, and the REST API. The plugin’s behavior and settings are unchanged — existing setups upgrade in place. See the changelog for the full list.
Add a really simple Under Construction page to your website by enabling this plugin. Use IP whitelisting and a secret URL to grant access to selected users without logging in.
Go to the settings page in Settings > Really Simple Under Construction. Enable by checking the checkbox. The Under Construction page is only visible to visitors who are not logged in. You can optionally configure:
<ol>
<li>The Under Construction page itself — paste any HTML (DOCTYPE, <style>, <body> etc. are supported, scripts are stripped).</li>
<li>A secret word that lets you bypass the page via a URL like <code>?yoursecret</code>. A cookie is then stored so the same browser keeps access.</li>
<li>The lifetime of that cookie, in days.</li>
<li>A list of IP addresses to whitelist for users and services that should always see the real site.</li>
</ol>

Really Simple Under Construction Page

Hide your site behind a really simple Under Construction page. Bypass with a secret-word URL or an IP whitelist for testing.

Mamotte! Login URL Changer vs Really Simple Under Construction Page