Block wp-login vs XO Security

Block wp-login.php and use a secret login URL Block wp-login prevents automated requests from reaching the default WordPress login endpoint. It creates a secret login URL for authorised users and adds Apache rewrite rules that return a 403 Forbidden response for direct requests to wp-login.php. Because blocked requests are rejected before WordPress loads, the plugin can reduce the server resources consumed by bots repeatedly targeting wp-login.php. Features include: Choose your own secret login slug or generate a random one. Block direct access to the default wp-login.php endpoint with a 403 response. Continue to support password resets, registration and WordPress administration email verification through the secret login URL. Rebuild the secret login file after a WordPress core update. Optionally email administrators when the login URL changes. Optionally notify the site owner when an administrator signs in from an IP address that is not on the known-IP list. Important compatibility information Block wp-login requires an Apache web server with mod_rewrite and a writable .htaccess file in the WordPress root directory. It is not compatible with Nginx or servers that do not honour .htaccess rules. Hiding the default login endpoint reduces automated login traffic, but it is not a replacement for strong passwords, two-factor authentication, updates, backups or other appropriate security controls.

XO Security is a plugin to enhance login related security. This plugin does not write to .htaccess file. Besides Apache, LiteSpeed, Nginx and IIS also work. Functions Record login log. Limit login attempts. Add Captcha to the login form and comment form. Change the URL of the login page. Enable two-factor authentication (2FA) for login. Login Alert. Disable login by mail address. Disable login by user name. Change login error message. Disable XML-RPC and XML-RPC Pingback. Disable REST API. Disable author archive page. Remove comment author class of comments list. Remove the username from the oEmbed response data. WooCommerce login page protection. Anti-spam comment. Hide WordPress version information. Edit the author slug. Disable RSS and Atom feeds. Activate maintenance mode. Delete the readme.html file. WordPress multisite considerations If you set the login page separately for the main site and the subsite, you will not be able to use the password loss function of the subsite. We recommend that you set the login page to be common to all sites.