Login Guard

What it does

Every WordPress site signs in at the same address: your site name followed by /wp-login.php. Login Guard gives your sign-in page a new address that you choose, such as yoursite.com/team-door.

The part you choose is called the slug. A slug is simply the last part of a web address.

Once it is on, anyone who is not signed in and tries /wp-login.php or /wp-admin gets nothing useful. You decide what they see instead.

Why you might want it

Most attacks on WordPress are not people. They are robots that visit thousands of sites a day and guess passwords at the usual sign-in address.

If the robots cannot find your sign-in page, they cannot guess. Your site does less work, and your activity log stays quiet enough to spot anything real.

It works best together with strong passwords and two-factor sign-in. A hidden door is good; a hidden door with a good lock is better.

Turn it on

1. Go to Stack Guard, then the Login tab, and find Login address.
2. Switch on Custom Login URL.
3. In Login Slug, type the new address. Use lowercase letters, numbers and hyphens, for example team-door. Pick something that is not easy to guess, so avoid login or admin.
4. Under Blocked access, choose what people see if they try the old address. The safest choice is Show 404 Not Found Page, your normal "page not found" screen.
5. Click Save Changes.
6. Copy your new sign-in address from the top of the Login tab and bookmark it now, before you sign out.

Your choices for blocked visitors

Show 404 Not Found Page: the visitor sees your theme's "page not found" screen, as if the sign-in page never existed. This gives robots the least to work with.

Redirect to Homepage: the visitor is quietly sent to your home page.

Redirect to WordPress Page: the visitor is sent to a page you pick in Page, for example an "Access denied" page you wrote. It keeps working if your site moves to a new domain.

Redirect to Custom URL: the visitor is sent to any web address you type in Redirect URL. Remember to update it if your domain changes.

Optional: add an access token

An access token is a secret word added to the end of your sign-in address, like yoursite.com/team-door/?access=k4f9-2mzq-8wht-p3xa. Without it, even someone who knows your slug gets the blocked response.

It only works while Custom Login URL is on.

1. In Login address, switch on Login Access Token.
2. Click Generate to make a random token, or type your own. Capital letters count, so Key and key are different.
3. Choose a Token Mode. Remember Device (Cookie) asks for the token once, then remembers that browser for the number of days in Remember For. Require Every Browser Session asks again each time the browser is closed and opened.
4. Click Save Changes, then bookmark the full address including the token.

Optional: catch robots with a honeypot

Switch on Login Honeypot to add an invisible box to your sign-in form. People never see it, so they leave it empty. Robots fill in every box they find, which gives them away.

A robot caught this way is told the username or password is wrong, so it learns nothing. You will see it in the activity log as "Blocked - Honeypot".

What you and your visitors will notice

Your sign-out, lost password and registration links update themselves to the new address. Password reset emails use it too.

Shortcuts like yoursite.com/login and yoursite.com/admin no longer lead to the sign-in page.

When you are already signed in, opening your sign-in address shows a "page not found" screen. That is normal: go to /wp-admin instead, which works as usual while you are signed in.

If you use password-protected posts, their page code contains your sign-in address, because WordPress sends the post password through it. Add an access token if that matters to you.

Some other plugins expect the usual sign-in address. If a membership or login plugin stops working, check its settings for a login address and use your new one.

If you forget the address or get locked out

First, look for your bookmark. Anyone who is signed in with full Stack Guard access can also see the address at the top of the Login tab.

If nobody can sign in, you can switch Login Guard off from a file on your server called wp-config.php. It is a settings file in the main folder of your site. You can open it with your web host's file manager or an FTP program. If you are not sure how, your web host's support team can do this for you.

1. Open wp-config.php and find the line that says That's all, stop editing!
2. Just above that line, add: define( 'SMG_DISABLE_LOGIN_GUARD', true ); and save the file.
3. Sign in at the usual address, yoursite.com/wp-login.php. A red notice at the top of the dashboard reminds you that recovery mode is on.
4. Go to the Login tab and note your sign-in address, or change it.
5. Remove the line you added from wp-config.php, so Login Guard protects the site again.

If two-factor sign-in gets stuck during recovery

If the second sign-in step does not load while recovery mode is on, also add define( 'SMG_DISABLE_2FA', true ); on the next line, and remove it again afterwards.

For a bigger emergency, define( 'SMG_SAFE_MODE', true ); switches off every protection that could keep you out: Login Guard, two-factor, lockouts, bans, country blocking, firewall rules, CAPTCHA and IP reputation checks. Remove it as soon as you are back in.

Which plan includes it

Login Guard, the access token and the honeypot are included in every plan, including Free. They keep working if a paid plan ends, so changing plans can never lock you out.