by MVP Plugins 0 (0 reviews)

NibbleSecure – Hide Login, Limit Login Attempts & Brute Force Shield

Name: NibbleSecure – Hide Login, Limit Login Attempts & Brute Force Shield
Author: MVP Plugins

Hide your login page behind a secret URL, limit login attempts, and block brute force attacks. Includes lockout thresholds and instant email alerts.

NibbleSecure ranks #59,128 among WordPress.org plugins with 0+ active installations, is #3,855 of 5,058 in the Security category, and was last updated Oct 9, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.4

v1.1.0 Current Version v1.1.0

Updated 3 weeks ago Last Update on 09 Oct, 2026

Refreshed 2 days ago Last Refreshed on

#3,855 of 5,058 in Security Actively maintained

View on WordPress.org

Rank

#59,128

— No change

Active Installs

-100%

KW Avg Position

189

1 worse

Downloads

211

+1 today

Support Resolved

— No change

Rating

Review 0 out of 5

0 (0 reviews)

Next Milestone 10

Total Progress 30%

0+ 10+

31,560

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 7 more installs to reach 10+

Rank Changes

Current #59,128

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

0.0

0 reviews

Overall 0%

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.1.0
Last Updated: Oct 09, 2026
Requires WP: 6.0+
Tested Up To: 7.1.4
PHP Version: 7.4 or higher
Author: MVP Plugins

Support & Rating

Rating: ☆ ☆ ☆ ☆ ☆ 0
Reviews: 0
Support Threads: 0
Resolved: 0%

Keywords

brute force protection firewall hide login page limit login attempts login security

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Akismet Anti-spam: Spam Protection

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

5M+ installs

#11

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

View all Security-and-spam-protection plugins

Frequently Asked Questions

Common questions about NibbleSecure – Hide Login, Limit Login Attempts & Brute Force Shield

NibbleSecure replaces public access to your default wp-login.php page with a unique secret URL. Anyone or any bot trying to reach the standard login page is blocked before it ever loads.

Your secret login URL is shown in an on-screen notice right after you activate the plugin, and it's always visible on the NibbleSecure settings page. If you'd also like a copy emailed to you, use the "Email Me" button on the settings page: enter your admin email and it will send your current secret login URL to your inbox. No email is sent automatically; this only happens when you choose to click that button.

NibbleSecure tracks failed login attempts by IP address. Once an IP crosses your configured maximum attempts, it's locked out from logging in for your set lockout period. If the same IP gets locked out again within 24 hours, each repeat offense adds your configured "Compounding Progression Interval" on top of the base lockout, so persistent attackers face progressively longer bans. Visitor IPs are read from the connection itself, and Cloudflare is detected automatically. If your site sits behind a different proxy or CDN, see the nibblesecure_trusted_proxy_headers filter to configure which proxy header, if any, should be trusted for identifying the real visitor IP. This is a code-level setting for developers, added via a filter in your theme or a small custom plugin; it is not a toggle found on the Brute Force settings tab, since the correct header depends on your specific hosting/CDN setup.

No. NibbleSecure runs entirely on your own WordPress database. It doesn't load external tracking scripts or require any paid cloud API to hide your login page or limit login attempts.

No. NibbleSecure is built to be lightweight. Login attempt checks and lockout lookups are optimized to have minimal impact on your site's load time.

The locked settings tabs preview PRO-only features: Two-Factor Authentication (2FA/TOTP), malware & file integrity scanning, session hijacking control, Application-Layer (L7) DDoS protection, advanced .htaccess server hardening, manual IP/country blocking, a login math CAPTCHA, and scheduled backups with one-click restore. These are unlocked by installing the separate, self-hosted NibbleSecure PRO add-on from our website. The free version on WordPress.org is fully functional without it.

Two-Factor Authentication (2FA/TOTP) is not included in this free version. It's available exclusively through the separate NibbleSecure PRO add-on. Once installed, NibbleSecure PRO adds TOTP-based two-factor authentication compatible with Google Authenticator, Authy, Microsoft Authenticator, 1Password, and other standard authenticator apps. It also adds emergency backup codes and secure email recovery if you ever lose your device.

Two-Factor Authentication (2FA) adds a second verification step after your username and password: a time-based 6-digit code from an authenticator app. This keeps your account protected even if your password is stolen, guessed, or leaked elsewhere. This free version protects your login with a secret login URL, limit login attempts, and brute force protection; full 2FA/TOTP support is available in the NibbleSecure PRO add-on.

Yes. The 404 Scanner section at the bottom of the Hide Login tab counts requests for pages that do not exist. When one IP address triggers too many of them within your detection window (6 errors in 1 minute by default), it is blocked with a 403 Forbidden response for the block duration you set (60 minutes by default). Visits to the login page without your secret login URL count as well. The scanner is switched on for new installs. If you are updating from an earlier version it starts switched off, so an update never blocks visitors on its own; turn it on from the 404 Scanner section at the bottom of the Hide Login tab.

It is designed not to. Logged-in administrators, genuine search engine crawlers (verified by reverse DNS, not just their User-Agent), and missing images, stylesheets, scripts or fonts are never counted, and requests from private or loopback addresses are ignored so a proxy cannot cause a site-wide block. Every block also expires on its own. If you ever do block yourself, add define( 'NIBBLESECURE_DISABLE_404_SCANNER', true ); to your wp-config.php to switch the scanner off immediately. Developers can also use the nibblesecure_404_should_track and nibblesecure_404_ignored_extensions filters.