MarcusPope

A WordPress plugin that converts all URL formats to root-relative URLs to enable seamless transitioning between staging/production host environments and debugging/testing from mobile devices, without the use of hackish tactics like textual find-replace strategies or risky hosts/NAT spoofing strategies.
With Root Relative URLs you can browse your development site from http://localhost/ or http://127.0.0.1/ or from a named network resource like http://mycomputername/ without worrying about links redirecting you back to your site’s URL.
This plugin also modifies the tinyMCE hooks so links and media embedded with built-in tools will only insert URLs from the first forward slash after the domain (i.e. the root of your site.) This means when you push content changes to a staging or production environment they are guaranteed to reference the correct target instead of accidentally referencing a production resource in development or, worse-yet, a development-exclusive resource in production.
It supports path-based MU Installations, but does not support domain-based MU sites due to architectural deficiencies in the WordPress core.
Version 1.5 fixes an infinite redirect problem that is a result of a core bug in WordPress. If you have problems with the <!–more–> tag or permalinks for custom post types, please read the FAQ or new Install Steps for support.
Version 2.2 allows for adding certain URL’s or partial URL’s to a blacklist, meaning I won’t use root relative urls, but dynamic absolute URLs instead for displaying content. This will fix problems with 3rd party plugins, and can be configured on the General Settings page.
<h3>Arbitrary section</h3>

Root Relative URLs

Converts all URLs to root-relative URLs for hosting the same site on multiple IPs, easier production migration and better mobile device testing.

Julio Potier

Grégory Viguier

SecuPress

This plugin forbids access to https://example.com/wp-login.php and creates new urls, like https://example.com/login or https://example.com/logout. 
This is a great way to limit bots trying to brute-force your login (trying to guess your login and password). Of course, the new URLs are easier to remember too.
Also remember: the use of this plugin does NOT exempt you to use a strong password. Moreover, never use “admin” as login, this is the first attempt for bots.
By the way, if you are looking for a complete security solution, take a look at <a href="https://wordpress.org/plugins/secupress/" rel="ugc">SecuPress</a>: Move Login is included inside.
<h4>Multisite</h4>
Yes! The plugin must be activated from your network. 
Note 1: this plugin deals only with <code>wp-login.php</code>, not with <code>wp-signup.php</code> nor with <code>wp-activate.php</code> (yet). That means https://example.com/register will still redirect to https://example.com/wp-signup.php. I think this will be the next step though, but no ETA. 
Note 2: if users/sites registrations are open, you shouldn’t use this plugin yet. There are some places where the log in address is hard coded and not filterable. A <a href="https://core.trac.wordpress.org/ticket/31495" title="Always use 'login' as $scheme parameter for "login-ish" URLs, and other inconsistencies" rel="nofollow ugc">bug ticket</a> is open.
<h4>Requirements</h4>
<ul>
<li>You will need a FTP access: if the <code>.htaccess</code>/<code>web.config</code> file is not writable (you will need to add the given rules manually), or if something is wrong and you can’t log in anymore (see the FAQ in that case).</li>
<li>Should work on IIS7+ servers but not tested (I guess you should probably save a copy of your <code>web.config</code> file before the plugin activation).</li>
<li>For Nginx servers, the rewrite rules are not written automatically of course, but they are provided as information in the plugin settings page.</li>
</ul>

Move Login

Don't know why I didn't find "Move Login" first. I already tested 2 alternative free plugins and it was deficient in different ways.  "Move Login" is powerful, light and easy to set up. Very nice find. Thanks.

The best of the 3 ones I tested

Change your login URL for something like https://example.com/login and stop login brute-force attempts.

Root Relative URLs vs Move Login