Block wp-login
Blocks direct access to wp-login.php and replaces it with a secret login URL to reduce brute-force traffic on Apache servers.
The facts
- Rating
- 4.7★ from 9
- Active installs
- 600+
- Price
- Free
- Last updated
- 13 Aug 2026
- Added
- Apr 2017
- Requires WP
- 5.0
- Tested up to
- WP 7.1
- Requires PHP
- 7.0
- Downloads
- 22,244
Our analysis
AI-assistedBlock wp-login is a WordPress plugin designed to enhance the security of your site's login process by blocking access to the default wp-login.php endpoint. It allows you to create a secret login URL for authorised users, helping to prevent automated requests and reduce server resource consumption from bots targeting the login page.
This plugin is suitable for users who want to improve their site's security by obscuring the login URL. It requires an Apache web server with mod_rewrite and is not compatible with Nginx or other servers that do not support .htaccess rules.
Best for: This plugin is best for WordPress site owners looking to enhance login security.
What it does well
- ✓Creates a secret login URL for authorised users
- ✓Blocks direct access to wp-login.php with a 403 response
- ✓Supports password resets and registration through the secret login URL
- ✓Can notify administrators of login URL changes
- ✓Rebuilds the secret login file after WordPress core updates
Where it falls short
- •Requires Apache web server with mod_rewrite
- •Not compatible with Nginx or servers that do not honour .htaccess rules
- •Does not replace the need for strong passwords or other security measures
Verdict
Block wp-login offers a straightforward way to secure your login process by obscuring the default endpoint. It may be beneficial for those focused on reducing automated login attempts.
From the developer
Oliver Campion's own description of Block wp-login, lightly tidied.
Block wp-login.php and use a secret login URL
Block wp-login prevents automated requests from reaching the default WordPress login endpoint. It creates a secret login URL for authorised users and adds Apache rewrite rules that return a 403 Forbidden response for direct requests to wp-login.php.
Because blocked requests are rejected before WordPress loads, the plugin can reduce the server resources consumed by bots repeatedly targeting wp-login.php.
Features include:
- Choose your own secret login slug or generate a random one.
- Block direct access to the default wp-login.php endpoint with a 403 response.
- Continue to support password resets, registration and WordPress administration email verification through the secret login URL.
- Rebuild the secret login file after a WordPress core update.
- Optionally email administrators when the login URL changes.
- Optionally notify the site owner when an administrator signs in from an IP address that is not on the known-IP list.
Important compatibility information
Block wp-login requires an Apache web server with mod_rewrite and a writable .htaccess file in the WordPress root directory. It is not compatible with Nginx or servers that do not honour .htaccess rules.
Hiding the default login endpoint reduces automated login traffic, but it is not a replacement for strong passwords, two-factor authentication, updates, backups or other appropriate security controls.