by Oliver Campion
4.7 (9 reviews)
Block wp-login
Blocks direct access to wp-login.php and replaces it with a secret login URL to reduce brute-force traffic on Apache servers.
Compatible with WP 7
v1.5.7
Current Version v1.5.7
Updated 2 days ago
Last Update on 23 Jul, 2026
Refreshed 8 hours ago
Last Refreshed on
Rank
#8,440
-17 this week
Active Installs
600+
-9.4%
KW Avg Position
59
-0.5 better
Downloads
20K
+22 today
Support Resolved
0%
—
No change
Rating
94%
Review 4.7 out of 5
4.7
(9 reviews)
Next Milestone 700
600+
700+
803
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 66 more installs to reach 700+
Rank Changes
Current
#8,440
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
4.7
9 reviews
Overall
94%
5
8
(89%)
4
0
(0%)
3
0
(0%)
2
1
(11%)
1
0
(0%)
Tracked Keywords
Showing 4 of 4| Keyword | Position | Change | Type | Updated |
|---|---|---|---|---|
| hide login | 44 | — | Tag | 23 hours ago |
| custom login url | 45 | — | Tag | 23 hours ago |
| Brute Force | 66 | — | Tag | 23 hours ago |
| login security | 81 | — | Tag | 23 hours ago |
Unlock Keyword Analytics
Track keyword rankings, search positions, and discover new ranking opportunities with a Pro subscription.
- Full keyword position tracking
- Historical ranking data
- Competitor keyword analysis
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.5.7
- Last Updated
- Jul 23, 2026
- Requires WP
- 5.0+
- Tested Up To
- 7
- PHP Version
- 7.0 or higher
- Author
- Oliver Campion
Support & Rating
- Rating
- ★ ★ ★ ★ ★ 4.7
- Reviews
- 9
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
7K+ installs
#2,724
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#988
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#7
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
Frequently Asked Questions
Common questions about Block wp-login
wp-login.php is the standard WordPress endpoint for login, registration and password-reset requests. Its predictable location is frequently targeted by automated bots.
No. It blocks automated traffic aimed at the default wp-login.php address and can reduce the associated server load. If someone discovers the secret login URL, normal WordPress authentication still applies. Use strong unique passwords and other suitable security controls as well.
No. Block wp-login relies on Apache mod_rewrite and .htaccess. Do not activate it on Nginx or another server that does not process Apache .htaccess rules.
Yes. Password-reset emails, reset forms and registration links use the secret login URL. WordPress administration email verification is also supported.
The plugin detects a changed WordPress version and rebuilds its secret copy of the current wp-login.php file. If the server is overloaded, it safely defers that work until a later administrator request.
First check the notification email sent when the URL was configured. If you have command-line access, deactivating the plugin with WP-CLI runs its cleanup routine and restores the default login endpoint. Otherwise, ask your hosting provider or developer to remove the section between # BEGIN BlockWPLogin and # END BlockWPLogin from the WordPress .htaccess file before deactivating the plugin. Take a backup before editing .htaccess.
Go to Settings > Permalinks, clear the Login address field and save the settings, or deactivate the plugin normally. The plugin removes its rewrite rules and generated login file.