Julio Potier

Grégory Viguier

SecuPress

<p>This plugin forbids access to <strong>https://example.com/wp-login.php</strong> and creates new urls, like <strong>https://example.com/login</strong> or <strong>https://example.com/logout</strong>.<br />
This is a great way to limit bots trying to brute-force your login (trying to guess your login and password). Of course, the new URLs are easier to remember too.</p>
<p>Also remember: the use of this plugin does NOT exempt you to use a strong password. Moreover, never use “admin” as login, this is the first attempt for bots.</p>
<p>By the way, if you are looking for a complete security solution, take a look at <a href="https://wordpress.org/plugins/secupress/" rel="ugc">SecuPress</a>: Move Login is included inside.</p>
<h4>Multisite</h4>
<p>Yes! The plugin must be activated from your network.<br />
<strong>Note 1</strong>: this plugin deals only with <code>wp-login.php</code>, not with <code>wp-signup.php</code> nor with <code>wp-activate.php</code> (yet). That means <strong>https://example.com/register</strong> will still redirect to <strong>https://example.com/wp-signup.php</strong>. I think this will be the next step though, but no ETA.<br />
<strong>Note 2</strong>: if users/sites registrations are open, you shouldn’t use this plugin yet. There are some places where the log in address is hard coded and not filterable. A <a href="https://core.trac.wordpress.org/ticket/31495" title="Always use 'login' as $scheme parameter for "login-ish" URLs, and other inconsistencies" rel="nofollow ugc">bug ticket</a> is open.</p>
<h4>Requirements</h4>
<ul>
<li>You will need a FTP access: if the <code>.htaccess</code>/<code>web.config</code> file is not writable (you will need to add the given rules manually), or if something is wrong and you can’t log in anymore (see the FAQ in that case).</li>
<li>Should work on IIS7+ servers but not tested (I guess you should probably save a copy of your <code>web.config</code> file before the plugin activation).</li>
<li>For Nginx servers, the rewrite rules are not written automatically of course, but they are provided as information in the plugin settings page.</li>
</ul>


Move Login

Don't know why I didn't find "Move Login" first. I already tested 2 alternative free plugins and it was deficient in different ways.  "Move Login" is powerful, light and easy to set up. Very nice find. Thanks.

The best of the 3 ones I tested

Change your login URL for something like https://example.com/login and stop login brute-force attempts.

Freemius

Sanjeev Aryal

Mini Plugins

<p>WPForce Logout allows administrators to log out all or selected users with a single click, enhancing the security of user accounts. It helps protect against brute force attacks and allows you to manage compromised accounts by forcing logout.</p>
<p>If you need to work on your WordPress website without any users being logged in, this plugin allows you to force all user accounts to be logged out. Additionally, if you suspect that your WordPress site is hacked, forcing logout will help you secure your site. This plugin is also useful for membership or pay-per-view sites to prevent password sharing among users.</p>
<p>You can easily view online/offline users, last login activity from the users tab.</p>
<h3>Features:</h3>
<ul>
<li>Force Logout All Users</li>
<li>Logout Specific User(s)</li>
<li>Bulk Logout Users</li>
<li>View Online Users</li>
<li>Last Login Activity Tracking</li>
<li>Idle User Logout [PRO]</li>
<li>Auto logout on browser close [PRO]</li>
<li>Session expiration [PRO]</li>
<li>Logout redirect [PRO]</li>
</ul>
<p><a href="https://miniplugins.com/wp-force-logout/" rel="nofollow ugc">Upgrade to PRO</a></p>
<h3>What’s Next?</h3>
<p>If you like WPForce Logout, then consider checking out my other projects:<br />
– <a href="https://miniplugins.com/wp-frontend-delete-account/" rel="nofollow ugc">WP Frontend Delete Account</a> – Allows your customers to delete their account by themselves.<br />
– <a href="https://miniplugins.com/woocommerce-auto-delete-old-orders/" rel="nofollow ugc">WooCommerce Auto Delete Old Orders</a> – Automatically delete old WooCommerce orders.<br />
– <a href="https://miniplugins.com/wc-auto-delete-users-with-no-orders/" rel="nofollow ugc">WooCommerce Auto Delete Users With No Orders</a> – Automatically delete users with no purchase history.<br />
– <a href="https://miniplugins.com/customer-journey-for-woocommerce/" rel="nofollow ugc">WooCommerce Customer Journey</a> – Displays every step of the customer until the order of the product in the orders page.</p>


WPForce Logout – WordPress User Login Logout Management Plugin

Forcefully log out users from your WordPress site, manage online status, and track last login activity.

Move Login vs WPForce Logout – WordPress User Login Logout Management Plugin