wpgear

<p>Ext Security.<br />
Dashboard & Daily-Digest about users activity.<br />
Now the console has a widget that displays last login users, whith: Date-Time, IP address (whith Whois info) and Device type/Browser.</p>
<h4>Features</h4>
<ul>
<li>Even without going to the site admin area, you will be informed about the activity of the current day.</li>
<li>Any person can be a recipient of notifications. Not necessarily the Administrator.</li>
<li>Now in the Admin console you have a new widget with a list of users in order of decreasing Login time.</li>
<li>Determine and save the IP address, device and browser details, from which the was made Login. (if your server is configured correctly). For better informational content, in order to be able to determine the parameters of the User’s devices (OS, Browser, Type Device), you should have a PHP extension on the server: “Browscap”. Alternatively, you can use the Lite-Version – Plugin: “quick-browscap” from the official WP repository.</li>
<li>It is important to understand that the time to enter the site and the time of the last activity of the user are different events.</li>
<li>Displays “Login Success” Statistics for each User.</li>
<li>Displays Count “Users Activity” in Admin Bar.</li>
</ul>


Users Login Monitor

A freeware plugin, for daily-notify site administrator, about users who logged in during the day.

Julio Potier

Grégory Viguier

SecuPress

<p>This plugin forbids access to <strong>https://example.com/wp-login.php</strong> and creates new urls, like <strong>https://example.com/login</strong> or <strong>https://example.com/logout</strong>.<br />
This is a great way to limit bots trying to brute-force your login (trying to guess your login and password). Of course, the new URLs are easier to remember too.</p>
<p>Also remember: the use of this plugin does NOT exempt you to use a strong password. Moreover, never use “admin” as login, this is the first attempt for bots.</p>
<p>By the way, if you are looking for a complete security solution, take a look at <a href="https://wordpress.org/plugins/secupress/" rel="ugc">SecuPress</a>: Move Login is included inside.</p>
<h4>Multisite</h4>
<p>Yes! The plugin must be activated from your network.<br />
<strong>Note 1</strong>: this plugin deals only with <code>wp-login.php</code>, not with <code>wp-signup.php</code> nor with <code>wp-activate.php</code> (yet). That means <strong>https://example.com/register</strong> will still redirect to <strong>https://example.com/wp-signup.php</strong>. I think this will be the next step though, but no ETA.<br />
<strong>Note 2</strong>: if users/sites registrations are open, you shouldn’t use this plugin yet. There are some places where the log in address is hard coded and not filterable. A <a href="https://core.trac.wordpress.org/ticket/31495" title="Always use 'login' as $scheme parameter for "login-ish" URLs, and other inconsistencies" rel="nofollow ugc">bug ticket</a> is open.</p>
<h4>Requirements</h4>
<ul>
<li>You will need a FTP access: if the <code>.htaccess</code>/<code>web.config</code> file is not writable (you will need to add the given rules manually), or if something is wrong and you can’t log in anymore (see the FAQ in that case).</li>
<li>Should work on IIS7+ servers but not tested (I guess you should probably save a copy of your <code>web.config</code> file before the plugin activation).</li>
<li>For Nginx servers, the rewrite rules are not written automatically of course, but they are provided as information in the plugin settings page.</li>
</ul>


Move Login

Don't know why I didn't find "Move Login" first. I already tested 2 alternative free plugins and it was deficient in different ways.  "Move Login" is powerful, light and easy to set up. Very nice find. Thanks.

The best of the 3 ones I tested

Change your login URL for something like https://example.com/login and stop login brute-force attempts.

Users Login Monitor vs Move Login