Ben Treder

Secure Login Shield helps you lock down your WordPress login page. 
By default, WordPress exposes <code>/wp-login.php</code> and <code>/wp-admin/</code>. Bots hammer these URLs every day.
This plugin gives you a private login slug (e.g. <code>/dragon-lair</code>) and hides the default login endpoint:
<ul>
<li>Defaults to <code>/wp-login.php</code> until you change it.</li>
<li>Once changed, only your custom slug works.</li>
<li>Direct access to <code>/wp-login.php</code> shows a 404 Not Found (stealth mode).</li>
<li>Logged-out visitors hitting <code>/wp-admin/</code> are redirected to the homepage.</li>
<li>Deactivate the plugin → everything reverts to normal.</li>
</ul>
Made with ❤️ by <a href="https://BenTreder.com" rel="nofollow ugc">Ben Treder</a>
<h3>Features</h3>
<ul>
<li>Private login slug (e.g. <code>/dragon-lair</code>, <code>/control-center</code>, <code>/secret-gate</code>)</li>
<li>Stealth 404 protection: Bots hitting <code>/wp-login.php</code> see “Not Found”</li>
<li>Homepage redirect: <code>/wp-admin/</code> (logged out) → homepage</li>
<li>Easy settings page under Settings → Secure Login Shield</li>
<li>Safe activation/deactivation: no core hacks, auto-reverts when disabled</li>
</ul>
<h3>Contribute & Support</h3>
<ul>
<li>Website: <a href="https://BenTreder.com" rel="nofollow ugc">BenTreder.com</a> </li>
<li>Author: <a href="https://profiles.wordpress.org/bentreder/" rel="nofollow ugc">Ben Treder</a> </li>
<li>Issues & Feature Requests: Please open a ticket on <a href="https://BenTreder.com" rel="nofollow ugc">BenTreder.com</a> </li>
<li>Like this plugin? ⭐ Leave a review and help spread the word! </li>
<li>☕ Support development: <a href="https://www.buymeacoffee.com/bentreder" rel="nofollow ugc">Buy Me a Coffee</a></li>
</ul>

Treder Secure Login Shield

Create a private login URL and hide /wp-login.php with stealth 404s. Logged-out /wp-admin/ visits redirect to your homepage.

Abhishek Sinha

Abhishek Site Cleanup Controls gives developers and site owners fine-grained control over 35+ WordPress features that are often unnecessary. Each feature has a simple on/off toggle, organised into five logical groups inside Settings -> Site Cleanup Controls.
No features are enabled by default — activate only what you need.
<h4>Security</h4>
<ul>
<li>User Enumeration — Block ?author=N redirect attacks that expose usernames.</li>
<li>Author Archives — Return 404 for author archive pages.</li>
<li>XML-RPC + Pingback — Fully disable the XML-RPC endpoint and remove the X-Pingback header.</li>
<li>Plugin and Theme Editor — Set DISALLOW_FILE_EDIT to prevent in-admin file editing.</li>
<li>Application Passwords — Disable the Application Passwords feature.</li>
<li>REST API — Restrict REST API access to authenticated users only.</li>
<li>Right Click — Disable the browser context menu on the frontend.</li>
</ul>
<h4>Performance</h4>
<ul>
<li>Emojis — Remove all emoji scripts, styles, and DNS prefetch hints.</li>
<li>Embed Objects — Disable WordPress oEmbed and embed scripts.</li>
<li>Dashicons — Prevent Dashicons from loading for non-logged-in visitors.</li>
<li>Heartbeat — Deregister the Heartbeat API script.</li>
<li>Block Library CSS — Remove wp-block-library and global-styles stylesheets on the frontend.</li>
<li>Version Var (?ver=) — Strip ?ver= query strings from enqueued asset URLs.</li>
<li>PDF Thumbnails — Skip thumbnail generation for uploaded PDF files.</li>
<li>oEmbed — Remove oEmbed discovery links and disable autoembed.</li>
<li>Remote Block Patterns — Stop WordPress fetching patterns from api.wordpress.org.</li>
</ul>
<h4>Head Cleanup</h4>
<ul>
<li>Generator Meta Tag — Remove the WordPress version meta tag from head.</li>
<li>WLW Manifest — Remove the Windows Live Writer manifest link.</li>
<li>Really Simple Discovery (RSD) — Remove the RSD link tag.</li>
<li>Short Link — Remove the shortlink tag and HTTP header.</li>
<li>Adjacent Posts Links — Remove prev/next link tags from single post heads.</li>
<li>RSS Feeds — Redirect all feed URLs to the homepage.</li>
</ul>
<h4>Admin Cleanup</h4>
<ul>
<li>capital_P_dangit — Remove WordPress forced capitalisation filter.</li>
<li>Screen Options and Help Tabs — Hide Screen Options and Help dropdowns.</li>
<li>Howdy to Welcome — Replace “Howdy,” with “Welcome,” in the admin bar.</li>
<li>Navigation Items in Admin Bar — Remove WP logo, site name, updates, and comments.</li>
<li>Clean Dashboard — Remove all default dashboard widgets.</li>
<li>Privacy Tools — Hide Export/Erase Personal Data from the Tools menu.</li>
<li>Site Health Page — Hide Site Health from the Tools menu.</li>
<li>WP Login Logo and Favicon — Hide the WordPress logo on the login page.</li>
<li>Admin Email Verification Prompt — Disable the admin email confirm interstitial.</li>
<li>Empty Trash (1 week) — Shorten automatic trash-emptying from 30 days to 7 days.</li>
</ul>
<h4>Content</h4>
<ul>
<li>Comments — Disable comments sitewide.</li>
<li>Post Revisions — Disable revision storage.</li>
<li>Search — Redirect all search queries to the homepage.</li>
</ul>
<h4>WordPress Features</h4>
<ul>
<li>Thumbnails / Featured Images — Remove post thumbnail support.</li>
<li>Widgets — Disable all widgets and sidebars.</li>
<li>Navigation Menus — Remove nav menu theme support.</li>
<li>Tags — Unregister tags from posts.</li>
<li>Categories — Unregister categories from posts.</li>
<li>Post Formats — Remove post format theme support.</li>
<li>Custom Fields — Remove custom fields meta box from editor.</li>
<li>Excerpts — Remove excerpt support from posts and pages.</li>
<li>Trackbacks — Remove trackback support from posts.</li>
<li>Attachment Pages — Redirect attachment URLs to the file directly.</li>
<li>Automatic Updates — Disable automatic core, plugin, and theme updates.</li>
<li>Self Pings — Stop WordPress pinging your own site.</li>
<li>jQuery Migrate — Remove jQuery Migrate script on the frontend.</li>
</ul>

Abhishek Site Cleanup Controls

Selectively disable WordPress features to improve performance, security, and cleanliness. Toggle each feature individually from a single settings page …

Treder Secure Login Shield vs Abhishek Site Cleanup Controls