Ben Treder

Secure Login Shield helps you lock down your WordPress login page. 
By default, WordPress exposes <code>/wp-login.php</code> and <code>/wp-admin/</code>. Bots hammer these URLs every day.
This plugin gives you a private login slug (e.g. <code>/dragon-lair</code>) and hides the default login endpoint:
<ul>
<li>Defaults to <code>/wp-login.php</code> until you change it.</li>
<li>Once changed, only your custom slug works.</li>
<li>Direct access to <code>/wp-login.php</code> shows a 404 Not Found (stealth mode).</li>
<li>Logged-out visitors hitting <code>/wp-admin/</code> are redirected to the homepage.</li>
<li>Deactivate the plugin → everything reverts to normal.</li>
</ul>
Made with ❤️ by <a href="https://BenTreder.com" rel="nofollow ugc">Ben Treder</a>
<h3>Features</h3>
<ul>
<li>Private login slug (e.g. <code>/dragon-lair</code>, <code>/control-center</code>, <code>/secret-gate</code>)</li>
<li>Stealth 404 protection: Bots hitting <code>/wp-login.php</code> see “Not Found”</li>
<li>Homepage redirect: <code>/wp-admin/</code> (logged out) → homepage</li>
<li>Easy settings page under Settings → Secure Login Shield</li>
<li>Safe activation/deactivation: no core hacks, auto-reverts when disabled</li>
</ul>
<h3>Contribute & Support</h3>
<ul>
<li>Website: <a href="https://BenTreder.com" rel="nofollow ugc">BenTreder.com</a> </li>
<li>Author: <a href="https://profiles.wordpress.org/bentreder/" rel="nofollow ugc">Ben Treder</a> </li>
<li>Issues & Feature Requests: Please open a ticket on <a href="https://BenTreder.com" rel="nofollow ugc">BenTreder.com</a> </li>
<li>Like this plugin? ⭐ Leave a review and help spread the word! </li>
<li>☕ Support development: <a href="https://www.buymeacoffee.com/bentreder" rel="nofollow ugc">Buy Me a Coffee</a></li>
</ul>

Secure Login Shield

Create a private login URL and hide /wp-login.php with stealth 404s. Logged-out /wp-admin/ visits redirect to your homepage.

Rafal Gierlicki

NETSENSAI Shield offers a range of security features, including:
Changing the login URL to reduce brute force attack risks.
Disabling the REST API (WP API JSON) for non-logged-in users.
Disabling XML-RPC to prevent unauthorized access.
Disabling the WordPress file editor to avoid accidental or malicious changes.
Disabling Application Passwords to block unauthorized API access.
Applying advanced HTTP security headers (e.g., HSTS, X-Frame-Options, Content-Security-Policy).
Integration with W3 Total Cache:
Permanently disable .htaccess writes by W3TC
Runtime disabling of Page Cache UI
One-time full cache flush on first admin page load
Automatic cache flush on Secure Options save
Physical cleanup and permanent disable via the W3TC API
Suppression of Site Health REST API availability notices for non-logged-in users (removes false Site Health errors while maintaining full API blocking).
In addition, the plugin provides helpful user feedback:
Email notifications when the login URL changes – sends a localized HTML email (Polish or English) with your old and new login links, change date and the plugin logo, so you remember to update your bookmarks.
Admin popup when disabling the WP API JSON – displays a friendly modal warning that disabling the REST API may break plugins like WooCommerce or contact forms. The popup includes a purchase link to upgrade to the PRO version if you need this feature without losing functionality.
Scoped styling – the custom colour for the “Save changes” button is now limited to the Secure Options page, so other admin pages keep the default WordPress look.
Promotional banner assistant – notifies administrators of summer discount codes and NETSENSAI Shield PRO features.
The free version provides both core and advanced Level 3 security functionalities. A PRO version offers extended support, additional features, and automatic protection enhancements.

NETSENSAI Shield

Hardens and protects your site by locking down login, REST API, XML‑RPC, file editor, and applying HTTP security headers.

Secure Login Shield vs NETSENSAI Shield