by Defyn 0 (0 reviews)

Defyn Security Manager – Hide Login, 2FA & Brute-Force Protection

Name: Defyn Security Manager – Hide Login, 2FA & Brute-Force Protection
Author: Defyn

Hide wp-admin behind a custom login URL and stop brute-force attacks with two-factor authentication, login limits, IP rules and an activity log.

Defyn Security Manager ranks #28,279 among WordPress.org plugins with 20+ active installations, is #1,020 of 1,590 in the Authentication category, and was last updated Sep 7, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Tested up to WP 6.8.10 (Current: 7.1.2)

v1.2.2 Current Version v1.2.2

Updated 2 weeks ago Last Update on 07 Sep, 2026

Refreshed 6 hours ago Last Refreshed on

#1,020 of 1,590 in Authentication Downloads -48.3% this week

View on WordPress.org

Rank

#28,279

— No change

Active Installs

20+

-20%

KW Avg Position

147.5

25.5 better

Downloads

462

+2 today

Support Resolved

— No change

Rating

Review 0 out of 5

0 (0 reviews)

Next Milestone 30

Total Progress 20%

20+ 30+

10,016

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 8 more installs to reach 30+

Rank Changes

Current #28,279

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

0.0

0 reviews

Overall 0%

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.2.2
Last Updated: Sep 07, 2026
Requires WP: 5.8+
Tested Up To: 6.8.10
PHP Version: 7.4 or higher
Author: Defyn

Support & Rating

Rating: ☆ ☆ ☆ ☆ ☆ 0
Reviews: 0
Support Threads: 0
Resolved: 0%

Keywords

Brute Force hide login login security two factor

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,760

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,009

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

5M+ installs

Wordfence Security - Firewall, Malware Scan, and Login Security

Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention

All-In-One Security (AIOS) – Security and Firewall

1M+ installs

#61

MainWP Child - Securely Connects to the MainWP Dashboard to Manage Multiple Sites

700K+ installs

#86

View all Authentication plugins

Frequently Asked Questions

Common questions about Defyn Security Manager – Hide Login, 2FA & Brute-Force Protection

Activate the plugin, open Defyn Security, Settings, and enter a custom slug for your login URL. From then on your login page lives at that secret address, and /wp-admin and /wp-login.php return a 404, a redirect, or a decoy screen, whichever you choose.

The fastest fix is to add this line to wp-config.php: define( 'DEFYN_BEM_DISABLE', true ); This bypasses all login interception so /wp-admin and /wp-login.php work normally again. A yellow admin notice reminds you to remove the line once you are back in. Your settings and 2FA data are kept. If you cannot edit wp-config.php, rename the plugin folder over SFTP from defyn-security-manager to defyn-security-manager.disabled. WordPress deactivates the plugin on the next page load. Rename it back when you are ready to re-enable.

Yes. Define DEFYN_BEM_TRUST_PROXY in wp-config.php so the plugin honours X-Forwarded-For and CF-Connecting-IP headers when detecting the visitor IP address.

Any app that supports standard RFC 6238 TOTP, including Google Authenticator, Authy, 1Password, Microsoft Authenticator and Bitwarden.

No. Front-end pages, the REST API and normal site behaviour keep working. Only the human login entry points move, and you can layer two-factor enforcement on top of the REST API and XML-RPC separately.

No. The plugin only runs its checks on login and admin requests, so it has no measurable impact on front-end page speed.

This release supports single-site activation only. Network-wide multisite support is on the roadmap.