Julio Potier

Grégory Viguier

SecuPress

<p>This plugin forbids access to <strong>https://example.com/wp-login.php</strong> and creates new urls, like <strong>https://example.com/login</strong> or <strong>https://example.com/logout</strong>.<br />
This is a great way to limit bots trying to brute-force your login (trying to guess your login and password). Of course, the new URLs are easier to remember too.</p>
<p>Also remember: the use of this plugin does NOT exempt you to use a strong password. Moreover, never use “admin” as login, this is the first attempt for bots.</p>
<p>By the way, if you are looking for a complete security solution, take a look at <a href="https://wordpress.org/plugins/secupress/" rel="ugc">SecuPress</a>: Move Login is included inside.</p>
<h4>Multisite</h4>
<p>Yes! The plugin must be activated from your network.<br />
<strong>Note 1</strong>: this plugin deals only with <code>wp-login.php</code>, not with <code>wp-signup.php</code> nor with <code>wp-activate.php</code> (yet). That means <strong>https://example.com/register</strong> will still redirect to <strong>https://example.com/wp-signup.php</strong>. I think this will be the next step though, but no ETA.<br />
<strong>Note 2</strong>: if users/sites registrations are open, you shouldn’t use this plugin yet. There are some places where the log in address is hard coded and not filterable. A <a href="https://core.trac.wordpress.org/ticket/31495" title="Always use 'login' as $scheme parameter for "login-ish" URLs, and other inconsistencies" rel="nofollow ugc">bug ticket</a> is open.</p>
<h4>Requirements</h4>
<ul>
<li>You will need a FTP access: if the <code>.htaccess</code>/<code>web.config</code> file is not writable (you will need to add the given rules manually), or if something is wrong and you can’t log in anymore (see the FAQ in that case).</li>
<li>Should work on IIS7+ servers but not tested (I guess you should probably save a copy of your <code>web.config</code> file before the plugin activation).</li>
<li>For Nginx servers, the rewrite rules are not written automatically of course, but they are provided as information in the plugin settings page.</li>
</ul>


Move Login

Don't know why I didn't find "Move Login" first. I already tested 2 alternative free plugins and it was deficient in different ways.  "Move Login" is powerful, light and easy to set up. Very nice find. Thanks.

The best of the 3 ones I tested

Change your login URL for something like https://example.com/login and stop login brute-force attempts.

webvitaly

<ul>
<li><strong><a href="https://1.envato.market/KdRNz" title="Advanced iFrame Pro" rel="nofollow ugc">Advanced iFrame Pro</a></strong></li>
<li><strong><a href="http://web-profile.net/wordpress/plugins/login-logout/" title="Plugin page" rel="nofollow ugc">Login-Logout</a></strong></li>
<li><strong><a href="http://web-profile.net/donate/" title="Support the development" rel="nofollow ugc">Donate</a></strong></li>
<li><strong><a href="https://github.com/webvitalii/login-logout" title="Fork" rel="nofollow ugc">GitHub</a></strong></li>
</ul>
<p>“Login-Logout” plugin adds widget with login or logout link. Also can be shown register or site-admin link. It is the replacement of the default Meta widget.</p>
<h4>If user is not logged in there are such links:</h4>
<ul>
<li>login (after login action user will return to previous page);</li>
<li>register (if user can register) (if checkbox is active);</li>
</ul>
<h4>If user is logged in there are such links:</h4>
<ul>
<li>welcome text with link to user profile (if checkbox is active);</li>
<li>logout (after logout action user will return to previous page);</li>
<li>site admin (if checkbox is active);</li>
</ul>


Login-Logout

Widget with login, logout, admin and register links. Replacement of the default Meta widget.

Move Login vs Login-Logout