Active installationsNewAdoption metric — not a quality score
WordPress.org ratingNo WordPress.org ratings yet
Official packageDirect from WordPress.org
Repository metrics are context, not quality scores. Active installations measure adoption and can strongly reflect a plugin’s age and historical popularity. Ratings, recent updates and “Tested up to” metadata also do not guarantee modern code, error-free operation, security, feature completeness or suitability for a particular site. Why active installs don’t tell the whole story →
WP PlugIndex currently records Protect WP Login – Password Protect wp-login.php with Basic Auth version 1.1.2 as active, updated 19d ago and tested up to WordPress 7.1.
Overview
About this plugin
Protect WP Login adds a second password in front of your WordPress login page. htaccess ). Bots and brute force attacks are rejected by the server, so they never reach WordPress, PHP or your database.
Why protect wp-login.php at the server level?
php loads WordPress and queries the database, even when it comes from a bot trying thousands of passwords. Plugins that limit login attempts or add a CAPTCHA still have to do that work for every attempt. With Protect WP Login the server rejects those requests before WordPress starts:
Brute force bots don’t consume PHP or database resources.
Attackers never see your login form, so they can’t try WordPress passwords.
No CAPTCHA to solve and no extra scripts on the login page.
It works together with Wordfence, Limit Login Attempts, two-factor authentication and other security plugins: it’s one more layer in front of them.
Features
Password protects wp-login.php with server-level HTTP Basic Authentication.
Optionally protects xmlrpc.php, another common target of brute force attacks.
Creates a random username and password on activation, and keeps them visible until you confirm you saved them.
Checks the protection right after writing the rules. If your hosting doesn’t support them, they are removed automatically so your site keeps working.
Status panel that shows whether the protection is really active.
Password protected posts keep working for your visitors.
Unlimited users, managed from the WordPress admin.
Translated into English, Spanish, German, French, Italian and Portuguese.
How it works
A visitor or a bot opens wp-login.php.
The web server asks for the extra username and password managed by the plugin.
Only with the right credentials the usual WordPress login form is shown. Wrong credentials are rejected by the server.
Requirements
Apache or LiteSpeed web server with.htaccess support (most shared hosting). On Nginx, the plugin shows the configuration to add to the server.
Single site installations. WordPress Multisite is not supported yet.
WordPress.org metadata
Plugin tags
Topics listed for this plugin in the WordPress.org directory.
basic auth
brute force
htaccess
login
security
Compatibility & maintenance
Compatibility & maintenance
Tested with WP 7.1
Marked as tested with the current WordPress 7.1 release.
Current WordPress releaseWordPress 7.1
WordPress.org Tested up to7.1
Minimum requirementsWordPress 6.0 · PHP 7.4
Update activity14 Oct 202619d ago
“Tested up to” is directory metadata supplied by the plugin author. WP PlugIndex does not turn an older declaration into a claim that the plugin is incompatible.
Changes recorded by WP PlugIndex
Recent tracked changes
Version1.1.1→1.1.2
Version1.1→1.1.1
Version1.0→1.1
WordPress compatibility6.6.7→7.1.3
WordPress requirement6.3→6.0
Tracking & source
WP PlugIndex tracks public WordPress.org directory metadata and records selected version, compatibility and availability changes as they are detected.
