Julio Potier

Grégory Viguier

SecuPress

This plugin forbids access to https://example.com/wp-login.php and creates new urls, like https://example.com/login or https://example.com/logout. 
This is a great way to limit bots trying to brute-force your login (trying to guess your login and password). Of course, the new URLs are easier to remember too.
Also remember: the use of this plugin does NOT exempt you to use a strong password. Moreover, never use “admin” as login, this is the first attempt for bots.
By the way, if you are looking for a complete security solution, take a look at <a href="https://wordpress.org/plugins/secupress/" rel="ugc">SecuPress</a>: Move Login is included inside.
<h4>Multisite</h4>
Yes! The plugin must be activated from your network. 
Note 1: this plugin deals only with <code>wp-login.php</code>, not with <code>wp-signup.php</code> nor with <code>wp-activate.php</code> (yet). That means https://example.com/register will still redirect to https://example.com/wp-signup.php. I think this will be the next step though, but no ETA. 
Note 2: if users/sites registrations are open, you shouldn’t use this plugin yet. There are some places where the log in address is hard coded and not filterable. A <a href="https://core.trac.wordpress.org/ticket/31495" title="Always use 'login' as $scheme parameter for "login-ish" URLs, and other inconsistencies" rel="nofollow ugc">bug ticket</a> is open.
<h4>Requirements</h4>
<ul>
<li>You will need a FTP access: if the <code>.htaccess</code>/<code>web.config</code> file is not writable (you will need to add the given rules manually), or if something is wrong and you can’t log in anymore (see the FAQ in that case).</li>
<li>Should work on IIS7+ servers but not tested (I guess you should probably save a copy of your <code>web.config</code> file before the plugin activation).</li>
<li>For Nginx servers, the rewrite rules are not written automatically of course, but they are provided as information in the plugin settings page.</li>
</ul>

Move Login

Don't know why I didn't find "Move Login" first. I already tested 2 alternative free plugins and it was deficient in different ways.  "Move Login" is powerful, light and easy to set up. Very nice find. Thanks.

The best of the 3 ones I tested

Change your login URL for something like https://example.com/login and stop login brute-force attempts.

Duck Dev

Joel James

Loggedin is a lightweight WordPress plugin that lets you easily limit the number of simultaneous active sessions a user can have. This is a crucial feature for membership sites, online courses, and other platforms where you need to prevent users from sharing their accounts.
<h3>🎁 Features</h3>
<ul>
<li>Set Global Limits: Define a maximum number of concurrent logins for all users.</li>
<li>Flexible Login Behavior: Choose to either block new logins when the limit is reached or automatically log out the oldest session to allow a new one.</li>
<li>Prevent Account Sharing: By limiting sessions, you can effectively stop users from sharing their login credentials with others.</li>
<li>Admin Control: Easily force log out a user from the admin dashboard, giving you full control over active sessions.</li>
<li>Developer-Friendly: The plugin is built with a hook-based architecture, making it highly customizable and extensible for developers.</li>
</ul>
<h3>📦 Addons</h3>
Enhance LoggedIn’s functionality with these simple yet powerful <a href="https://duckdev.com/addons/loggedin/" rel="nofollow ugc">add-ons</a>.
<ul>
<li>
<a href="https://duckdev.com/addon/limit-per-user/" rel="nofollow ugc">Limit Per User</a>: For more granular control, the Limit Per User addon allows you to set specific login limits for individual users, overriding the global settings. This is perfect for offering different tiers of access or special privileges.
</li>
<li>
<a href="https://duckdev.com/addon/real-time-logout/" rel="nofollow ugc">Real-time Logout</a>: This add-on ensures a truly seamless experience by checking for logouts in real time. When a user’s session is terminated in the background due to a login limit, the add-on will automatically refresh their page, instantly restricting access.
</li>
</ul>
<h3>🐛 Bug Reports</h3>
Found a bug? We welcome your bug reports! Please report any issues directly on the <a href="https://github.com/Joel-James/loggedin/issues" rel="nofollow ugc">Loggedin GitHub repository</a>.
Please note: GitHub is for bug reports and development-related issues only. For support, please use the WordPress.org support forums.

Loggedin – Limit Concurrent Sessions

Good Plugin

Good

Lightweight plugin that limits an account to a specific number of concurrent logins.

Move Login vs Loggedin – Limit Concurrent Sessions