WP Login Door
Adds a secret URL key to access the login page and lets you disable XML-RPC, protecting against bruteforce attacks.
The facts
- Rating
- 5★ from 6
- Active installs
- 400+
- Price
- Free
- Last updated
- 11 Jun 2025
- Added
- Aug 2016
- Requires WP
- 4.0.0
- Tested up to
- WP 6.8.8
- Downloads
- 4,842
Our analysis
AI-assistedWP Login Door is a WordPress plugin designed to enhance the security of your login page by requiring a specific pair of words in the URL for access. This adds an additional layer of protection against brute force attacks on the login page and XML-RPC API. It is suitable for users who want to secure their WordPress sites from unauthorised access attempts.
The plugin allows you to disable XML-RPC if it is not needed, which can further reduce potential attack vectors. The user can configure a custom error message for those who attempt to access the login page without the correct words.
Best for: This plugin suits WordPress site owners looking to improve their login security.
What it does well
- ✓Adds an extra security layer to the login page
- ✓Allows disabling of XML-RPC
- ✓Customisable error messages for unauthorised access
Where it falls short
- •Limited information on additional features or settings
- •No details on support or updates beyond the last update date
Verdict
WP Login Door provides a straightforward method to secure your login page. It may be beneficial for those concerned about brute force attacks.
From the developer
toxnico's own description of WP Login Door, lightly tidied.
Did you ever feel like your website or blog login page is ridiculously fragile and reachable, and could be easily broken in by an intruder?
Personally I hate to think of hundreds of people playing with my door lock hundreds of times a day. It’s the same with my blog login page.
On WordPress, there are two main potential vectors of bruteforce intrusion:
* http://my-site.com/wp-login.php, which is the login page
* http://my-site.com/xmlrpc.php, which is an API gateway for interacting with third party applications.
This plugin adds one security layer in front of your login page, and by the way you can also disable XML-RPC with a simple checkbox if you don’t need it (XML-RPC is a WIDELY used vector of attacks).
The idea is simple: you choose a pair of words, and when you want to access your login page, you just have to provide them in the URL like this: http://my-site.com/wp-login.php?word1=word2. That’s all!
If you try to access your login page without this pair of words, you get a configurable error message, where you can insult the attacker as much as you want 😉