Hidden Gates: Securing WordPress Login Paths

Proverb

“The wise do not boast of a locked door; they build a gate no enemy can find.”

Parable

There was once a steward of a great library. The front gate was always open, and thieves came nightly. So the steward built a new entrance hidden within the walls, only those with purpose could enter. The library prospered, not because the lock was stronger, but because the doorway was known only to those who belonged.

Introduction

Every WordPress website ships with a well‑known door:

https://yoursite.com/wp-admin

This is the first target attackers try. Bots roam the internet day and night scanning for this default login path, launching brute‑force attempts against any site that responds.

This scroll shows how to:

• Hide the login gate (DIY)
• Harden the internal locks
• Protect all major web servers
• Support modern load‑balanced WordPress setups

Knowledge freely given — because service precedes systems.

Why Change /wp-admin?

• Bots target it automatically
• Brute force attacks drain server resources
• Admin credentials are the crown jewels

Removing the visible gateway stops the majority of automated attacks before they even begin.

How To Do It

We conceal the original login path and reveal a new one, known only to the rightful steward.

Choose a unique path:

/olive-branch

We route it internally to wp-login.php without exposing the default.

Web Server Configuration

WordPress Internal (Plugin or Functions)

Simplest approach: use a lightweight plugin such as WPS Hide Login.

Or directly enforce rules in code:

// Disable XML‑RPC if not needed
add_filter('xmlrpc_enabled', '__return_false');

// Block direct access to wp-login.php
add_action('init', function() {
    if (strpos($_SERVER['REQUEST_URI'], 'wp-login.php') !== false) {
        wp_safe_redirect('/');
        exit;
    }
});

Apache (.htaccess)

Hide the default pages, reveal the new gate:

RewriteEngine On

# Hide default login page
RewriteCond %{REQUEST_URI} ^/wp-login\.php$ [OR]
RewriteCond %{REQUEST_URI} ^/wp-admin$
RewriteRule ^.*$ - [F,L]

# New login route
RewriteRule ^olive-branch$ wp-login.php [L]

Optional: lock /wp-admin by IP:

<Directory "/var/www/html/wp-admin">
    Require ip 203.0.113.42
    Require not ip all
</Directory>

LiteSpeed Web Server

LiteSpeed honors .htaccess rules, the same configuration applies.
To strengthen even further, enable reCAPTCHA / anti‑bot via LSCache panel.

NGINX

Place inside the appropriate server { } block:

# Hide defaults
location = /wp-login.php { return 404; }
location = /wp-admin       { return 404; }

# New gate
location = /olive-branch {
    rewrite ^/olive-branch$ /wp-login.php break;
}

IP‑limit admin area:

location /wp-admin {
    allow 203.0.113.42;
    deny all;
}

IIS (web.config)

<configuration>
  <system.webServer>
    <rewrite>
      <rules>
        <rule name="HideLogin" stopProcessing="true">
          <match url="^(wp-login\.php|wp-admin)$" />
          <action type="CustomResponse" statusCode="404" />
        </rule>
        <rule name="NewLogin">
          <match url="^olive-branch$" />
          <action type="Rewrite" url="wp-login.php" />
        </rule>
      </rules>
    </rewrite>
  </system.webServer>
</configuration>

HAProxy (for Load‑Balanced WordPress)

Mask login to backend nodes:

frontend fe_http
  bind *:80
  acl new_login_path path_beg /olive-branch
  http-request set-path /wp-login.php if new_login_path
  use_backend wp_backend

And protect admin area by IP:

  acl safe_ip src 203.0.113.42
  http-request deny if { path_beg /wp-admin } !safe_ip

When & Where To Apply Each Method

Single Server (most websites):

• .htaccess (Apache/LiteSpeed) or NGINX rule is enough
• Combine with 2FA and login rate‑limits

High‑Traffic / Load‑Balanced:

• Apply rules at HAProxy or WAF/CDN first
• Still secure individual backend servers

Enterprise Multi‑Region:

• Use global traffic managers + edge filtering
• Centralised identity with least privilege

The principle remains: remove the visible weakness, place strength where it counts.

DIY vs DIFY — The Path of Service

DIY (Do It Yourself)
Freely shared instructions allow any steward to secure their own gates.
Because wisdom multiplies when given, not sold.

DIFY (Done It For You)
Some systems are complex:

• Clusters
• Multi‑tenant hosting
• CDN + WAF components

When asked, help can be rendered. Not to profit from fear, but to ensure every steward holds the keys to their own kingdom.

Knowledge is not withheld; assistance is offered only where called upon.

Final Thoughts

A hidden gate is not secrecy, it is stewardship.

The danger never comes from the locked door everyone can see.
It comes from the arrogance of believing a lock is enough.

May every system we build:

• Serve those who trust it
• Stand without boasting
• Remain unseen by those who seek to destroy

Act Today — Steward Your Gate

Choose one action now:

• Change the login path
• Enable 2FA
• Limit login attempts
• Protect admin access by IP

Small steps remove great risk.
A lock everyone knows is not a lock at all.

Scripture

“And God saw every thing that He had made, and, behold, it was good.” — Bereshit 1:31

Safety freely given is good.
Those who serve do so without fear, for the Fear of YHVH is the beginning of wisdom.