Captchinoo, admin login page protection with Google recaptcha vs Hide My WP Ghost – Security & Firewall

Your login page is the single most attacked page on any WordPress site. Bots hit wp-login.php around the clock, guessing username and password combinations thousands of times a day. Captchinoo puts a human verification step in front of that form, so automated scripts are stopped before they ever reach your password check. Install it, pick the captcha style you like, and you are protected. There is nothing else to configure. Three captcha styles, one click apart Slide to unlock — a lightweight swipe slider, just like unlocking a phone. No external service, no API keys, works on desktop and touch devices. Icon captcha — the visitor picks the one icon that does not belong in the row. Friendly, image based, and no typing required. Google reCAPTCHA v2 — the familiar “I’m not a robot” checkbox, backed by Google’s own bot detection. Why site owners choose Captchinoo No puzzles to read. No distorted letters and no math questions. Your users are not punished for logging in. Genuinely lightweight. Only the assets for the captcha you actually selected are loaded, and only on the login page. Nothing is queued on the front end of your site. Works with caching. The login page is never cached by page caching plugins, so Captchinoo stays reliable where other captcha plugins break. Translation ready. Every string is translatable and the plugin ships with full text domain support. Zero configuration required. The slide captcha works the moment you activate the plugin — no account, no keys, no signup. Captchinoo Pro — three more ways to lock down your login The free plugin gives you three captcha styles for your WordPress login form. Captchinoo Pro adds three stronger layers on top: Two factor authentication (2FA) — the most powerful protection in the plugin. 2FA adds a second identity check on top of the password: the user confirms the login from their mobile device, so a stolen, leaked, or guessed password on its own is no longer enough to get into your site. Google reCAPTCHA v3 — invisible protection that never interrupts your users. Instead of asking anyone to click a box or solve a challenge, reCAPTCHA v3 scores each visitor silently in the background from their interactions with your site. You can run it everywhere without affecting your conversion rate, and it works best when it has the most context about how people use your site. hCaptcha — an independent alternative to Google’s service. hCaptcha blocks automated bots, spam, and abuse by asking visitors to complete a simple verification challenge, and it is the popular choice for site owners who would rather not route their traffic through Google. Pro includes everything in the free version, so you can switch between all six captcha styles at any time. External services This plugin can optionally use Google reCAPTCHA, a third party service, and only when you explicitly select “Google reCAPTCHA” as your captcha type and enter your own API keys. When that option is active, the visitor’s browser loads Google’s reCAPTCHA script from https://www.google.com/recaptcha/api.js, and your server sends the captcha response token together with the visitor’s IP address to https://www.google.com/recaptcha/api/siteverify in order to confirm the challenge was solved. No data is transmitted to Google when the Slide or Icon captcha is selected, and the plugin never sends data anywhere else. Google’s terms and privacy policy apply to that service: Terms of Service — Privacy Policy. Support If you have a problem, a question, or a feature request, please open a thread in the support forum. We answer every one. If Captchinoo helps keep your site safe, a review would mean a lot to us.

WP Ghost (formerly Hide My WP Ghost) is a WordPress security plugin focused on hack prevention that changes and secures default paths, filters requests through the 9G Firewall, and helps block automated scanners probing default WordPress URLs. Paths Security changes public URLs such as wp-login.php and restricts access to their default addresses. WP Ghost also includes two-factor authentication (2FA) and a Security Check with tasks for your site’s settings. WordPress security problems WP Ghost can help with Repeated failed logins: set attempt limits and lockout durations under Brute Force protection. Bots requesting wp-login.php: use a custom login URL and block the default address. Visible plugin folders: change the public paths used in your site’s HTML. Suspicious requests: use the 9G Firewall to filter supported attack patterns. Unclear security settings: run Security Check and review its prioritized tasks. Repeated WooCommerce payment attempts: set checkout attempt limits for each IP address. WP Ghost focuses on attack prevention and WordPress hardening. Keep WordPress and its plugins updated, maintain backups, and use malware scanning when you need to check for infected files. Official websites: WP Ghost and Hide My WP Ghost. How Paths Security changes public URLs WP Ghost changes and secures over 30 default WordPress paths, including wp-admin, wp-login.php, wp-content, wp-includes, admin-ajax.php, /wp-json, plugin directories, and theme folders. Paths Security rewrites public routes and can block requests to their old addresses. Changing a URL does not fix vulnerable plugin code or replace login authentication. 9G Firewall in version 7.0.15 Version 7.0.15 adds the 9G Firewall as the default filter on new installs. Choose it under WP Ghost > Firewall & Headers > Firewall Strength. WP Ghost uses server rules and application checks, depending on the request and configuration. Test forms and checkout after changing firewall settings. What the 9G Firewall checks SQL injection, cross-site scripting (XSS), directory traversal, and scanner probes in URLs and query strings Unauthenticated exploit payloads sent to admin-ajax.php and the /wp-json REST API File uploads containing PHP shells or scripts disguised as images Visitor comment and form submissions on firewall levels 3 and 4 Privilege-escalation attempts on user registration endpoints PHP object injection and Server-Side Request Forgery (SSRF) requests Read the 9G Firewall documentation. Ghost Doctor path checks and repairs Nginx needs rewrite rules outside .htaccess. Apache and managed hosts can also restrict rewrite settings. Cached CSS URLs can leave a page unstyled after path changes. Ghost Doctor runs from WP Ghost > Level of Security and tests the site the way a logged-out visitor loads it. It checks the homepage HTML, theme CSS and JS files, admin-ajax.php, the REST API, and the custom admin path. How Ghost Doctor repairs a broken path Reads your server type (Nginx, Apache, LiteSpeed, or IIS), checks whether rewrite rules are written to the server config file, and detects active cache plugins Applies repairs from least invasive to fallback, such as serving CSS and JS through WordPress while a cache clears or switching to a mode that needs no server rewrites Tests each repair right after applying it and reverts the change if the check still fails Saves a configuration snapshot before changing anything, so clicking Undo All Changes restores your previous setup Links to the exact hosting panel guide when a step requires a server reload outside WordPress Read the Ghost Doctor guide and the troubleshooting steps. AI Security Explanations Security Check runs locally and provides a free score from 0 to 100, with prioritized tasks. Clicking AI Security Explanations sends those findings and setup details to generate a report for your configuration. AI Security Explanations require a connected WP Ghost account with an active subscription and use a monthly allowance of checks. What the report returns One summary paragraph at the top answering whether your current configuration is exposed Plain headlines that replace internal task names with the actual risk on your server One instruction per finding telling you which setting or file to change An on-demand Details panel explaining what an attacker can do with that finding on your server type A re-ordered task list ranked by what exposes your site right now Only the findings on your Security Check screen and six setup parameters (server type, config writability, rewrite presence, cache plugin presence, security mode, and mapped file count) are sent. This AI request excludes page content, user records, passwords and database rows. Premium cloud event retention is a separate feature. Requests and activity covered by WP Ghost controls Brute force login and credential stuffing on wp-login.php, custom login forms, WooCommerce accounts, and REST API Application Passwords SQL injection (SQLi) and cross-site scripting (XSS) in URLs, query strings, and form submissions Plugin and theme probes that rely on default /wp-content/plugins/ folder names XML-RPC pingback amplification and unauthenticated /wp-json user scraping Automated bot reconnaissance looking for WordPress version tags, generator meta tags, and source map comments WooCommerce checkout card testing from repeated IP requests Features in the free plugin 1. Change and secure paths (Paths Security) Change wp-admin and wp-login.php to custom names and return a 404 or custom redirect on the default URLs Change the lost password, registration, and logout paths Rename wp-content, wp-includes, and the uploads path in public HTML Change admin-ajax.php and the /wp-json REST API route Activate protection in one click with 3 security presets: Minimal, Lite Mode + Firewall, or Lite Mode + Firewall + Brute Force + Logs + 2FA Verify your homepage, theme assets, and API routes with Frontend Check and Ghost Doctor before saving path changes Set role-based login and logout redirect URLs Style your custom login URL with the Login Page Designer using a custom logo, background, 12 layouts, and 10 color schemes 2. 9G Firewall and login security Filter requests with the 9G, 8G, or 7G Firewall rules Log in without passwords using Passkey 2FA (Face ID, Touch ID, Windows Hello, or hardware keys) Enable Authenticator app codes, email 2FA codes, backup codes, browser trust, and forced 2FA setup by user role Send HTTP security headers: Content-Security-Policy (CSP), HSTS, X-Frame-Options, and X-Content-Type-Options Block specific IP addresses, User-Agents, and referrers View blocked requests in the Security Threats Log with password and payment fields masked Track logins, role updates, and admin actions in the User Events Log Check the top 5 attack origin countries on the Overview GEO Threats Map Track your 0 to 100 Security Optimization Score on the Overview and Security Check screens Create expiring Temporary Logins and one-time Magic Login email links capped at the creator’s permission level 3. Footprint removal Strip WordPress version numbers and meta generator tags from the HTML head Remove source map references inside inline scripts and styles and strip HTML comments Block ?author=1 queries and unauthenticated REST API user enumeration Hide the top admin toolbar on the frontend for selected roles Disable wp-emoji scripts, RSD links, and wp-admin prefetch hints 4. Access and endpoint controls Disable xmlrpc.php requests when your site does not need XML-RPC integrations Restrict /wp-json REST API access to logged-in users; test integrations that use public endpoints Disable right-click and selected copy shortcuts on public pages; these controls do not prevent downloading page content Turn off directory browsing across WordPress folders 5. Brute force and checkout protection Add Google reCAPTCHA v2, v3, Enterprise, or one-time tokenized Math CAPTCHA to login and signup forms, with a built-in key tester Protect standard logins, Elementor and page-builder login widgets, and WooCommerce login screens Limit repeated WooCommerce checkout submissions and failed payment attempts from the same IP address Set custom attempt thresholds, lockout durations, and IP whitelists 6. Diagnostics and extra tools Repair broken path or cache setups with Ghost Doctor and revert any test using saved snapshots Work through a single prioritized Security Check task list grouped into action bands like “worth fixing this week” Rewrite specific CSS class names, IDs, or URLs in page output with Text & URL Mapping Log in with one click from Softaculous (cPanel, Plesk, DirectAdmin, Webuzo, CentOS Web Panel) and aaPanel WP Toolkit WP Ghost Premium features Ghost Mode preset: turns on all path changes, hides file extensions, and enables full footprint removal in one click Monthly allowance of AI Security Explanations included with your subscription Automated IP blocking when an address triggers repeated firewall or brute-force blocks AI Copyright Protection: crawler controls at the firewall and in robots.txt, including rules for GPTBot, ClaudeBot, PerplexityBot, CCBot and Bytespider Unlimited Security Threats Log and User Events Log entries with country, status, and threat filters, search, and CSV export 30-day cloud event retention for audit history Instant email alerts on brute-force lockouts or disabled logs, plus optional weekly threat summary emails Country blocking (Geo-Security) for the whole site or specific paths File extension hiding for .php, .css, .js, and .json URLs One-click database prefix rename, file permission repair, and SALT key regeneration PerplexityBot supports AI search discovery, not foundation model training. Review crawler rules before enabling AI Copyright Protection; blocking a search crawler can limit visibility in that service. See all WP Ghost Premium features. Technical compatibility Hosting environments: WP Engine, Kinsta, Flywheel, SiteGround, InMotion Hosting, HostGator, GoDaddy, DreamHost, FastComet, Bitnami Apache, Bitnami Nginx, Google Cloud, AWS Lightsail, LiteSpeed Hosting, Ploi.io, CloudPanel, RunCloud, Softaculous, aaPanel, Rocket.net, and YunoHost. Web servers: Nginx, Apache, LiteSpeed, and IIS. Plugins and builders: WooCommerce, Elementor, Divi, Bricks Builder, Blocksy, Avada, Nicepage, Riode, Gutenberg Block Editor, WPML, Polylang, Weglot, WP Rocket, LiteSpeed Cache (QUIC.cloud), W3 Total Cache, WP Super Cache, WP Fastest Cache, SiteGround Optimizer, NitroPack, Autoptimize, Hummingbird, Cachify, Cache Enabler, CDN Enabler, Asset CleanUp, Debloat, Wordfence Security, Sucuri Security, Solid Security, Defender Security, WP Cerber, Shield Security, BBQ Firewall, Really Simple SSL, Yoast SEO, Rank Math, All in One SEO, Squirrly SEO, Contact Form 7, Gravity Forms, Jetpack, bbPress, MainWP, ManageWP, FluentSMTP, Limit Login Attempts Reloaded, Loginizer, and WP Social.