by Click.ar 1 (0 reviews)

Protect WP Login – Password Protect wp-login.php with Basic Auth

Name: Protect WP Login – Password Protect wp-login.php with Basic Auth
Author: Click.ar

Password protect wp-login.php with HTTP Basic Authentication. Stops bots and brute force attacks at the server, before WordPress even loads.

Protect WP Login ranks #62,510 among WordPress.org plugins with 1+ active installations, is #1,099 of 1,659 in the Authentication category, a 1/5 rating from 0 reviews, and was last updated Oct 14, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1

v1.1.2 Current Version v1.1.2

Updated 3 weeks ago Last Update on 14 Oct, 2026

Refreshed 1 week ago Last Refreshed on

#1,099 of 1,659 in Authentication Actively maintained

View on WordPress.org

Rank

#62,510

— No change

Active Installs

-80%

KW Avg Position

2 worse

Downloads

921

+1 today

Support Resolved

— No change

Rating

20%

Review 1 out of 5

1 (0 reviews)

Next Milestone 10

Total Progress 20%

0+ 10+

49,573

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 8 more installs to reach 10+

Rank Changes

Current #62,510

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

1.0

0 reviews

Overall 20%

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.1.2
Last Updated: Oct 14, 2026
Requires WP: 6.0+
Tested Up To: 7.1
PHP Version: 7.4 or higher
Author: Click.ar

Support & Rating

Rating: ★ ☆ ☆ ☆ ☆ 1
Reviews: 0
Support Threads: 0
Resolved: 0%

Keywords

Basic auth Brute Force htaccess login security

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,015

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

All-In-One Security (AIOS) – Security and Firewall

MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites

700K+ installs

#86

View all Authentication plugins

Frequently Asked Questions

Common questions about Protect WP Login – Password Protect wp-login.php with Basic Auth

Plugins like Wordfence or Limit Login Attempts check each login attempt inside WordPress, after it has loaded. Protect WP Login blocks the request at the web server, before WordPress loads, so bots don't use your server resources. You can use both: Protect WP Login is an extra layer in front of your security plugin.

Connect to your site by FTP or with the file manager of your hosting, open the .htaccess file in the WordPress folder and delete the lines between # BEGIN Protect WP Login and # END Protect WP Login. You can also rename the wp-content/plugins/protect-wp-login folder to deactivate the plugin.

It works on Apache and LiteSpeed servers that allow .htaccess files, which covers most shared hosting. After writing the rules the plugin checks your site: if the server answers with an error, the rules are removed automatically and the status panel explains what happened.

Nginx doesn't read .htaccess files. The plugin page shows the configuration you (or your hosting provider) have to add to the Nginx server to protect wp-login.php with the same users.

Yes. Visitors can still unlock password protected posts and pages without knowing the extra credentials.

If you don't use Jetpack, the WordPress mobile app or another service that publishes through XML-RPC, enabling it blocks another common entry point for brute force attacks.

Browsers remember Basic Authentication credentials during the session, and most of them (Chrome, Firefox, Edge, Safari) offer to save them like any other password, so you don't have to type them again.

Go to the 'Protect WP Login' page in the admin menu. Enter a username and password and click 'Save' to add a user, or click 'Delete' next to an existing user. There is always at least one user.

A simple combination is enough to stop bots, because they are blocked before reaching WordPress. The password can't be the same as the username.

Basic Authentication sends the credentials in every request to wp-login.php, just like the WordPress login form. Use HTTPS (free with Let's Encrypt on most hosting) to keep them private.