by Muhammad Junaid Tariq 0 (0 reviews)

WPS Protect: Login URL & Security Headers

Name: WPS Protect: Login URL & Security Headers
Author: Muhammad Junaid Tariq

Move your login URL, stop brute-force attacks, and send HTTP security headers on every response. Lightweight, cache-friendly, no bloat.

WPS Protect ranks #53,453 among WordPress.org plugins with 0+ active installations, is #1,407 of 1,659 in the Authentication category, and was last updated Aug 16, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.4

v2.0.0 Current Version v2.0.0

Updated 2 months ago Last Update on 16 Aug, 2026

Refreshed 1 week ago Last Refreshed on

#1,407 of 1,659 in Authentication

View on WordPress.org

Rank

#53,453

— No change

Active Installs

-100%

KW Avg Position

N/A

— No change

Downloads

656

+1 today

Support Resolved

— No change

Rating

Review 0 out of 5

0 (0 reviews)

Next Milestone 10

Total Progress 40%

0+ 10+

25,885

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 6 more installs to reach 10+

Rank Changes

Current #53,453

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

0.0

0 reviews

Overall 0%

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 2.0.0
Last Updated: Aug 16, 2026
Requires WP: 6.2+
Tested Up To: 7.1.4
PHP Version: 7.2 or higher
Author: Muhammad Junaid Tariq

Support & Rating

Rating: ☆ ☆ ☆ ☆ ☆ 0
Reviews: 0
Support Threads: 0
Resolved: 0%

Keywords

Brute Force hide login login security Security Headers

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,015

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

All-In-One Security (AIOS) – Security and Firewall

MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites

700K+ installs

#86

View all Authentication plugins

Frequently Asked Questions

Common questions about WPS Protect: Login URL & Security Headers

Use the rescue URL shown when you saved the slug. If you no longer have it, add define( 'WPSP_DISABLE_LOGIN_GATE', true ); to wp-config.php, or run wp wpsp login-url over WP-CLI. Deactivating the plugin also restores wp-login.php, and your settings survive deactivation.

Login and REST requests are never cached, so brute-force protection and the login gate are unaffected. Security headers are sent by PHP, so on a page served from a full-page cache they may be served by your cache layer instead. If your host serves cached pages without invoking PHP, set the headers at the server level too.

Yes, but configure your proxy ranges under the brute-force settings first. Until you do, the plugin deliberately declines to block by IP address rather than risk locking out every visitor sharing a proxy address.

Enable "do not overwrite headers already set" if something else is already sending headers. Running two plugins that both hide the login URL is not supported — pick one.

Your settings are migrated automatically, including your login slug, HTTPS setting and any header values you saved. One thing intentionally does not carry over: 1.x applied a hard-coded Content-Security-Policy: default-src 'self' whenever you had not set one, which blocked inline scripts and styles on most sites. That fallback is gone. If you want a CSP, set one explicitly on the Security Headers tab.