Question About Wordpress Plugin

[edgarf76]

hHope all is well and you are having a great weekend. I am trying to find a reputable wordpress plugin that re-names the wp-admin login. Any help would be great. Thank you.

[universal4]

AllInOne WP Security does a GREAT job of renaming the admin login.

There are additional features as well, but that one I feel is the most important.

Just install it, and look in the left navigation, it is located in the BruteForce section.

Have a word picked out you want to use and it will move the login to domain.com/?wordchosen

Rick
Universal4

[MrBinaryAff]

We use Better WP Security, it has this option of changing wp-admin login as well.

[FruityJelena]

Hi there

Maybe this link could be useful to you
http://vc.wpbakery.com/

[ARZ]

Thanks Edgar for starting this thread

I am just taking a multiple brute force attacks on my website, renaming thi wp-admin seems like a great option!

Thanks once more

[universal4]

Brute Force attacks on wordpress logins start almost immediately after wp is installed.

When I set up new wordpress installs I often do so on an ip address first if there is a live html site, and then change it when its ready. I have to even be careful to remember to move the login because if I don't within days, sometimes even the next day, the attacks start.

As a normal course of the day for scammers, they scan the net looking for wp-login as well as a few other named login pages.

Rick
Universal4

[vmguide]

It is, what I would consider a myth, that changing the wp-admin would protect your site from brute force attacks. Here are two reasons why:
1. Any hacker or bot that have the tools to actually hack your site will also be able to find your login-page no matter what name it is given.
2. A lot of plugins and theme functions depend on the wp-admin location on the server. Moving or renaming it may cause crashes.

My advice:
1. Make sure you don't have any users with the default username "admin". If so delete it.
2. Set strong passwords that are canged on a regular basis.
3. Get a good security plugin that blocks brute force attacks, and maybe even use a firewall. Here are some examples:

https://ithemes.com/security/
https://sucuri.net/
https://www.wordfence.com/

[universal4]

I use to recommend All In One security, but now I use WP Cerber for securing fresh installs of Word Press.

It allows for easy use of moving the admin login.
If something goes wrong with the login move, you can ftp a file up and run it, and it will move the login back to the default location. (nice feature for emergencies, and those who might be less comfortable with word press)
It has a lot of other features you may or may not want to enable, such as turning off rpc stuff, auto blocking of failed logins, logging all logins and their IP, ip blocking and many more things.

The important thing is to use SOMETHING for extra security, and to do so right away.

Rick
Universal4

[wonderpunter]

I used wordfence but have found cerber much less resource hungry, I actually mad e the switch when i came into php problems with WF, since then not looked back

[universal4]

Thanks for confirming that wonderpunter, I actually never tried wordfence on my own sites, but have had a few clients over the years who had it on sites.

I also found wpcerber to be very smooth and less resource hungry...

Rick
Universal4

[schegolev100]

I don't use a plugin for this. You can rename the file yourself.

Use instruction:

1. Find the file " wp-login.php " in the root directory of the site, rename the file, for example in new.php.
2. Open the file in a text editor and replace all references to "wp-login.php " to " new.php", save the file.

Now WP will give 404 error to /wp-admin/ and wp-login.php.

P.S. instead of new.php use your random name.

[citizen42]

if you use a security plugin and you're happy with that and only need a plugin for wp-login.php, you can use "WPS Hide Login"- it does just that.

[Online Poker America]

Hey!

Definitely try using an all in one wp security, can't go wrong with that.

Good luck

[Former Member 14]

Simple solution...

If you have a static IP for your internet (aka your ISP), all you need to do is add a attaccess to your wp-admin folder, and ONLY allow access to that area, with your static IP.

Doesn't matter how many times a script kiddy or hacker attempts a brute force or any other action, if they are not using your ALLOWED IP, they wont get in. Of course, you also need to harden your WP install in other areas, all can be done without using plugins. Hence, site speed is maintained.

NB - If it's on the net, then no matter what you do it's not 100% safe.

However the object here, is to make it a PITA to hack. In which case, the abuser's will move to a softer target