Julio Potier

Grégory Viguier

SecuPress

This plugin forbids access to https://example.com/wp-login.php and creates new urls, like https://example.com/login or https://example.com/logout. 
This is a great way to limit bots trying to brute-force your login (trying to guess your login and password). Of course, the new URLs are easier to remember too.
Also remember: the use of this plugin does NOT exempt you to use a strong password. Moreover, never use “admin” as login, this is the first attempt for bots.
By the way, if you are looking for a complete security solution, take a look at <a href="https://wordpress.org/plugins/secupress/" rel="ugc">SecuPress</a>: Move Login is included inside.
<h4>Multisite</h4>
Yes! The plugin must be activated from your network. 
Note 1: this plugin deals only with <code>wp-login.php</code>, not with <code>wp-signup.php</code> nor with <code>wp-activate.php</code> (yet). That means https://example.com/register will still redirect to https://example.com/wp-signup.php. I think this will be the next step though, but no ETA. 
Note 2: if users/sites registrations are open, you shouldn’t use this plugin yet. There are some places where the log in address is hard coded and not filterable. A <a href="https://core.trac.wordpress.org/ticket/31495" title="Always use 'login' as $scheme parameter for "login-ish" URLs, and other inconsistencies" rel="nofollow ugc">bug ticket</a> is open.
<h4>Requirements</h4>
<ul>
<li>You will need a FTP access: if the <code>.htaccess</code>/<code>web.config</code> file is not writable (you will need to add the given rules manually), or if something is wrong and you can’t log in anymore (see the FAQ in that case).</li>
<li>Should work on IIS7+ servers but not tested (I guess you should probably save a copy of your <code>web.config</code> file before the plugin activation).</li>
<li>For Nginx servers, the rewrite rules are not written automatically of course, but they are provided as information in the plugin settings page.</li>
</ul>

Move Login

Don't know why I didn't find "Move Login" first. I already tested 2 alternative free plugins and it was deficient in different ways.  "Move Login" is powerful, light and easy to set up. Very nice find. Thanks.

The best of the 3 ones I tested

Change your login URL for something like https://example.com/login and stop login brute-force attempts.

Deepen Bajracharya

Protect your WordPress users’ sessions from prying eyes and snoopers!
The Inactive Logout plugin automatically terminates idle user sessions, safeguarding your site if users leave their sessions unattended.
A simple plugin which is easy to configure and use. After installing and activating it, just set the idle timeout from the plugin settings. From then on, any unattended idle WordPress sessions will be automatically terminated. You can also display a custom message to users, warning them that their session is about to end.
Try it out ==> <a href="https://tastewp.org/plugins/inactive-logout/" title="Demo Link" rel="nofollow ugc">Demo</a>
FEATURES:.
<ul>
<li>Change idle timeout time.</li>
<li>Count down of 10 seconds before actual logout. You can remove this feature if you dont want it.</li>
<li>Add only Wake Up! message where user will not logout but instead a wakeup message will be shown upon inactive.</li>
<li>Custom Popup Message.</li>
<li>Show idle message for non authenticated users or redirect them.</li>
<li>Concurrent user logouts.</li>
<li>Toast notification on Logout.</li>
<li>Redirect to a Different Page instead of Popup box. Create a page such as timeout page and add your content there by creating a blank template or style it as you wish according to your theme.</li>
<li>Multiple User Role Configurations for individual timeout and session logout redirects.</li>
<li>Logout to custom page or existing page.</li>
<li>Clean UI</li>
<li>WooCommerce Supported.</li>
<li>Multisite Support: Override all sites with one setting.</li>
</ul>
EXTEND OTHER FEATURES:
Few of the key features to <a href="https://inactive-logout.com/pricing/" title="Inactive Logout Pro" rel="nofollow ugc">Inactive Logout Pro</a>:
<ul>
<li>Auto browser close logout after defined duration.</li>
<li>Fully functional multi-tab support.</li>
<li>User Based Logout</li>
<li>Track Visitors based on (Login time, logout time, browser, online status, session duration, role, os, IP)</li>
<li>Force Logout All Users</li>
<li>Logout Specific User(s)</li>
<li>Bulk Logout Users</li>
<li>Concurrent Login Limits.</li>
<li>Last Login Activity</li>
<li>Override Multiple Login priority</li>
<li>User Lock whenever certain limit login has been reached.</li>
<li>Track user login sessions.</li>
<li>Logout redirects.</li>
<li>Login redirects.</li>
<li>Email notification and email template overrides for Locked concurrent session.</li>
<li>Disable inactive logout for specified pages according to your need. Check this <a href="https://gist.github.com/techies23/6d2852eedd6ae56c486056e021e4ee48" title="documentation" rel="nofollow ugc">Documentation</a> for additional post type support.</li>
<li>Disable native wordpress login popup after logout</li>
<li>Modal Customizer</li>
</ul>
**See the <a href="https://inactive-logout.com/" title="Inactive Logout" rel="nofollow ugc">Inactive Logout</a> homepage for further information.
Please consider giving a <a href="https://wordpress.org/support/plugin/inactive-logout/reviews/#new-post" title="5 star thumbs up" rel="ugc">5 star thumbs up</a> if you found this useful.

Inactive Logout


Great plugin, does exactly what it says it does. Looks clean, nicely customisable, thanks a lot!


Great!

Automatically logout idle user sessions, with logout redirections and concurrent limit logins all in one place.

Move Login vs Inactive Logout