by Oliver Campion 4.7 (9 reviews)

Block wp-login

Name: Block wp-login
Rating: 4.7 (9 reviews)
Author: Oliver Campion

Blocks direct access to wp-login.php and replaces it with a secret login URL to reduce brute-force traffic on Apache servers.

Block wp-login ranks #8,338 among WordPress.org plugins with 600+ active installations, is #520 of 5,058 in the Security category, a 4.7/5 rating from 9 reviews, and was last updated Oct 8, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1

v1.5.9 Current Version v1.5.9

Updated 3 weeks ago Last Update on 08 Oct, 2026

Refreshed 2 days ago Last Refreshed on

#520 of 5,058 in Security Top 25% by installs Downloads -17.9% this week Actively maintained

View on WordPress.org

Rank

#8,338

— No change

Active Installs

600+

-9.6%

KW Avg Position

53.8

— No change

Downloads

20K

+3 today

Support Resolved

100%

— No change

Rating

94%

Review 4.7 out of 5

4.7 (9 reviews)

Next Milestone 700

Total Progress 63%

600+ 700+

307

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 37 more installs to reach 700+

Rank Changes

Current #8,338

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

4.7

9 reviews

Overall 94%

8 (89%)

0 (0%)

1 (11%)

0 (0%)

Support Threads Overview

Resolved

Unresolved

Total Threads

Resolved

Unresolved

100%

Resolution Rate

Security History

Source: WPVulnerability

3 known vulnerabilities on record · 0 in the last 24 months · checked 3 months ago

Jun 27, 2019

Block wp-login [block-wp-login] < 1.3.2

Fixed in v1.3.2
Jun 27, 2019

Block wp-login [block-wp-login] < 1.3.2

Fixed in v1.3.2
Block wp-login [block-wp-login] < 1.3.2

Fixed in v1.3.2

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.5.9
Last Updated: Oct 08, 2026
Requires WP: 5.0+
Tested Up To: 7.1
PHP Version: 7.0 or higher
Author: Oliver Campion

Support & Rating

Rating: ★ ★ ★ ★ ★ 4.7
Reviews: 9
Support Threads: 1
Resolved: 100%

Keywords

Brute Force custom login url hide login login security security

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Akismet Anti-spam: Spam Protection

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

5M+ installs

#11

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

View all Security-and-spam-protection plugins

TL;DR

AI summary of the plugin's readme

Block wp-login is for administrators of self-hosted WordPress sites running on Apache who want to reduce automated login attacks. It replaces the default wp-login.php login page with a secret URL and blocks direct access to wp-login.php with a 403 response to cut down brute-force traffic.

Custom or random secret login slug
Blocks wp-login.php with 403 response
Supports password resets and registration
Supports admin email verification
Rebuilds secret login after core update
Email admins when login URL changes
Notifies owner of unknown-IP admin logins

Frequently Asked Questions

Common questions about Block wp-login

wp-login.php is the standard WordPress endpoint for login, registration and password-reset requests. Its predictable location is frequently targeted by automated bots.

No. It blocks automated traffic aimed at the default wp-login.php address and can reduce the associated server load. If someone discovers the secret login URL, normal WordPress authentication still applies. Use strong unique passwords and other suitable security controls as well.

No. Block wp-login relies on Apache mod_rewrite and .htaccess. Do not activate it on Nginx or another server that does not process Apache .htaccess rules.

Yes. Password-reset emails, reset forms and registration links use the secret login URL. WordPress administration email verification is also supported.

The plugin detects a changed WordPress version and rebuilds its secret copy of the current wp-login.php file. If the server is overloaded, it safely defers that work until a later administrator request.

First check the notification email sent when the URL was configured. If you have command-line access, deactivating the plugin with WP-CLI runs its cleanup routine and restores the default login endpoint. Otherwise, ask your hosting provider or developer to remove the section between # BEGIN BlockWPLogin and # END BlockWPLogin from the WordPress .htaccess file before deactivating the plugin. Take a backup before editing .htaccess.

Go to Settings > Block wp-login, clear the Private login address field and save the settings, or deactivate the plugin normally. The plugin removes its rewrite rules and generated login file.