WordPress Security Free plugin
Make your WordPress login invisible
Every WordPress site on Earth ships with the same front door: wp-login.php.
Attackers know exactly where it is — which is why it’s the single most hammered URL on your site.
Datametric Login Shield hides that door and stacks real defenses behind it.
Key takeaways
wp-login.phpis identical on every WordPress site, so it’s the most-attacked URL on the web — targeted by automated bots that never had to find it.- Datametric Login Shield moves your login to a secret URL and returns a 404 for
wp-login.phpandwp-adminto logged-out visitors. - Hiding the URL is one layer; the plugin adds brute-force lockouts, two-factor authentication (TOTP), CAPTCHA, IP allow/deny rules and a login audit log — defense in depth.
- It changes no core files and adds no rewrite rules, so it works on any host and fully reverts when deactivated. All features are free.
The most attacked door on the internet
WordPress powers a huge share of the web — often cited around 40%. That popularity has a
side effect: because every site uses the same login path, attackers never have to look
for your login page. WordPress tells them where it is. Automated botnets simply request
yoursite.com/wp-login.php and start guessing.
wp-login.php,
almost all aimed at the username admin. None of it was targeted at you —
it’s just bots working down a list of millions of sites. But it’s hammering your server,
bloating your logs, and it only has to get lucky once.
What that automated traffic usually looks like:
Brute force
A bot pounds wp-login.php with common passwords against a
guessed username. High volume, few IPs.
Credential stuffing
Username/password pairs leaked from other breaches are replayed here, betting on password reuse — spread across many IPs.
Username harvesting
Before guessing passwords, bots scrape valid usernames via
?author=1 redirects and the REST endpoint /wp-json/wp/v2/users.
XML-RPC amplification
xmlrpc.php historically let attackers test many passwords in a
single request, multiplying brute-force speed and dodging naive rate limits.
Hiding the door helps — but it isn’t the whole lock
Let’s be honest, because your credibility depends on it: moving your login URL is
security through obscurity. It won’t stop a determined, targeted attacker who can
inspect traffic or find a theme that hardcodes wp-login.php.
What it does do is remove you from the untargeted, automated flood — the overwhelming majority of login attacks, which only ever hit the default path. That kills the noise. The real controls behind the hidden door stop the attackers who are smarter than a blind bot. That layering is exactly what defense in depth means, and it’s why Login Shield is more than a URL trick.
A guided tour of the panel
A login address only you know
Change your login from wp-login.php to something like
/secret-door. Visitors who don’t know the address get a plain 404 — there’s
no hint a login page ever existed there.
Crucially, it works by intercepting the request in PHP. It never
renames or edits a single core file, and it adds no .htaccess or rewrite rules. Deactivate
the plugin and your default login returns instantly — nothing to clean up. That’s why it
runs on any host: Apache, Nginx, LiteSpeed, anywhere.
Lock it down for the bots that get through
- Brute-force lockout. Too many failed logins from an IP? It’s locked out for a window you choose. An allowlist means you can never lock yourself out, and it fails open on a database error, so a glitch can never bar every user.
- Two-factor (TOTP). A six-digit code from Google Authenticator, Authy or 1Password — so a stolen password alone is useless. Ships with single-use backup codes and per-role enforcement. (TOTP apps and backup codes only — no SMS or email OTP.)
- Access hardening. Hides
/wp/v2/usersfrom logged-out callers, redirects?author=Nscans, shows a single generic login error, and can optionally disable XML-RPC. - IP allow / deny. Restrict login to your office or VPN ranges (CIDR supported), or block known-bad addresses outright.
- CAPTCHA (optional). reCAPTCHA v2/v3, hCaptcha or Cloudflare Turnstile, verified server-side.
See exactly who is knocking
A filterable audit log records logins, failed attempts, logouts and lockouts — with date, user and IP. Get an email the moment an IP is locked out or an administrator signs in, and export the whole log to CSV (with formula-injection safely neutralized).
Built so you’re never stranded
The dashboard shows your status at a glance and lets you copy your login URL or email it to
yourself in one click. Locked out anyway? Rename the plugin folder over FTP, or set one recovery constant
in wp-config.php (DMLS_DISABLE_2FA, DMLS_DISABLE_IP_ACCESS,
DMLS_DISABLE_CAPTCHA), fix the setting, and remove it. You are designed to always have a way back in.
What it does not do
No honest security tool claims to make you bulletproof. Here’s the straight talk:
✗ It does not make your site “unhackable” or your login “undiscoverable.”
✗ It is not a firewall (WAF) and it does not stop DDoS.
✗ It can’t help if a theme or plugin hardcodes wp-login.php.
✗ A distributed botnet rotating thousands of IPs can slip under a per-IP lockout — that’s what 2FA and CAPTCHA are for.
✗ It is no substitute for strong, unique passwords and keeping WordPress updated.
✗ Behind a caching layer, exclude your login URL from cache (most caching plugins already do).
Privacy-friendly by default
Everything runs on your own server. Nothing leaves it unless you enable CAPTCHA — in which case the challenge and visitor IP are sent to your chosen provider (Google, hCaptcha or Cloudflare) to verify. Failed-attempt records auto-delete after 24 hours; audit events after 7 days.
Because IP addresses are personal data under the GDPR, the plugin gives you the tools to stay compliant: turn logging off, store anonymized IPs, delete everything on uninstall, and auto-generate privacy-policy text. It hands you the controls — it doesn’t pretend compliance is automatic.
Coming from WPS Hide Login?
Switching is seamless. Login Shield automatically imports your existing custom login URL, so your current address keeps working the moment you activate — no reconfiguration, no downtime.
Standing on open-source shoulders
Datametric Login Shield is an independent, GPLv2 fork of WPS Hide Login, originally created by WPServeur, NicolasKulka and wpformation. The core login-interception logic is derived from their proven work — our sincere thanks to the original authors. (Independent fork; not affiliated with or endorsed by them.)
Requirements & compatibility
Frequently asked questions
/wp-content/plugins/ via FTP or your host’s file manager.
Your default wp-login.php works again immediately — because nothing on disk was ever changed.
Close the door the bots are counting on
Hide your login, lock down WordPress, and see every attempt — all in one free, privacy-friendly plugin.
What are your thoughts on this topic?
Every article is an open conversation. Whether you have a counter-argument, a local example, or a different perspective based on your own experience, your contribution makes this space better.
0 Comments