DevOrbit Login Shield

DevOrbit Login Shield lets you change the address of your login page from the default /wp-login.php to a slug you choose, such as /my-login/. Requests to wp-login.php, and requests to /wp-admin/ from anyone who is not logged in, are redirected to the home page (or shown a 404, your choice) instead of reaching a login form.

This does not change any core files, database table, or rewrite rules. It intercepts the request early and serves WordPress’s own login logic at your chosen URL, so every feature of the normal login screen, including lost password, registration, and logout, continues to work exactly as before, just at a different address.

Features

• Choose any custom slug for your login page.
• Direct requests to wp-login.php are blocked, and wp-admin is blocked for logged-out visitors.
• Blocked requests are intercepted before WordPress can redirect to the login screen, so your custom slug is never exposed in a Location header.
• Optionally removes the «Log in» and «Register» links themes show to logged-out visitors, so the custom URL stays out of your public HTML.
• Choose whether blocked requests are redirected home or shown a 404.
• Logged-in users, AJAX, cron, and WP-CLI are never affected.
• No rewrite rules, no .htaccess changes, no database schema changes.
• Settings are removed cleanly on uninstall.

A note on security

This plugin reduces exposure to automated login scanners and brute-force bots that target /wp-login.php by default. It is not a replacement for strong passwords, two-factor authentication, or a login rate-limiting plugin, and it should be used alongside those, not instead of them.