Protect WP Login – Password Protect wp-login.php with Basic Auth
| 开发者 |
clickar
alebuo |
|---|---|
| 更新时间 | 2026年10月14日 23:34 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
.htaccess). Bots and brute force attacks are rejected by the server, so they never reach WordPress, PHP or your database.
Why protect wp-login.php at the server level?
Every request to wp-login.php loads WordPress and queries the database, even when it comes from a bot trying thousands of passwords. Plugins that limit login attempts or add a CAPTCHA still have to do that work for every attempt. With Protect WP Login the server rejects those requests before WordPress starts:
- Brute force bots don't consume PHP or database resources.
- Attackers never see your login form, so they can't try WordPress passwords.
- No CAPTCHA to solve and no extra scripts on the login page.
- It works together with Wordfence, Limit Login Attempts, two-factor authentication and other security plugins: it's one more layer in front of them.
- Password protects
wp-login.phpwith server-level HTTP Basic Authentication. - Optionally protects
xmlrpc.php, another common target of brute force attacks. - Creates a random username and password on activation, and keeps them visible until you confirm you saved them.
- Checks the protection right after writing the rules. If your hosting doesn't support them, they are removed automatically so your site keeps working.
- Status panel that shows whether the protection is really active.
- Password protected posts keep working for your visitors.
- Unlimited users, managed from the WordPress admin.
- Translated into English, Spanish, German, French, Italian and Portuguese.
- A visitor or a bot opens
wp-login.php. - The web server asks for the extra username and password managed by the plugin.
- Only with the right credentials the usual WordPress login form is shown. Wrong credentials are rejected by the server.
- Apache or LiteSpeed web server with
.htaccesssupport (most shared hosting). On Nginx, the plugin shows the configuration to add to the server. - Single site installations. WordPress Multisite is not supported yet.
安装:
- Install the plugin from 'Plugins > Add New Plugin', or upload the plugin files to the
/wp-content/plugins/protect-wp-logindirectory. - Activate the plugin through the 'Plugins' menu in WordPress.
- You will be taken to the 'Protect WP Login' page, where the generated username and password are shown. Save them before logging out, or create your own users on the same page.
屏幕截图:
常见问题:
How is it different from other login security plugins?
Plugins like Wordfence or Limit Login Attempts check each login attempt inside WordPress, after it has loaded. Protect WP Login blocks the request at the web server, before WordPress loads, so bots don't use your server resources. You can use both: Protect WP Login is an extra layer in front of your security plugin.
I got locked out. How do I get back in?
Connect to your site by FTP or with the file manager of your hosting, open the .htaccess file in the WordPress folder and delete the lines between # BEGIN Protect WP Login and # END Protect WP Login. You can also rename the wp-content/plugins/protect-wp-login folder to deactivate the plugin.
Will it work on my hosting?
It works on Apache and LiteSpeed servers that allow .htaccess files, which covers most shared hosting. After writing the rules the plugin checks your site: if the server answers with an error, the rules are removed automatically and the status panel explains what happened.
Does it work on Nginx?
Nginx doesn't read .htaccess files. The plugin page shows the configuration you (or your hosting provider) have to add to the Nginx server to protect wp-login.php with the same users.
Do password protected posts still work?
Yes. Visitors can still unlock password protected posts and pages without knowing the extra credentials.
Should I also protect xmlrpc.php?
If you don't use Jetpack, the WordPress mobile app or another service that publishes through XML-RPC, enabling it blocks another common entry point for brute force attacks.
Do I need to enter the extra password every time?
Browsers remember Basic Authentication credentials during the session, and most of them (Chrome, Firefox, Edge, Safari) offer to save them like any other password, so you don't have to type them again.
How do I add or delete users?
Go to the 'Protect WP Login' page in the admin menu. Enter a username and password and click 'Save' to add a user, or click 'Delete' next to an existing user. There is always at least one user.
Do I need a complex username and password?
A simple combination is enough to stop bots, because they are blocked before reaching WordPress. The password can't be the same as the username.
Is it secure without HTTPS?
Basic Authentication sends the credentials in every request to wp-login.php, just like the WordPress login form. Use HTTPS (free with Let's Encrypt on most hosting) to keep them private.
更新日志:
- Translations: the plugin name is no longer translated, and Spanish uses the informal form, following the WordPress.org translation style guides.
- New: interface translated into Spanish, German (formal and informal), French, Italian and Portuguese (Brazil and Portugal). Regional variants, such as Spanish from Argentina or Mexico, use the closest translation.
- New: link to leave a review on the plugin page.
- Improved description, FAQ and screenshots.
- Updated plugin and author URLs.
- New: the generated credentials stay visible until you confirm you saved them (before, they disappeared after 60 seconds).
- New: automatic check after writing the rules. If the server returns an error 500, the rules are removed so the site keeps working.
- New: status panel with the protection state and a "Check again" button.
- New: option to also protect xmlrpc.php.
- New: instructions for Nginx servers.
- Fix: password protected posts asked visitors for the extra credentials.
- Fix: passwords with special characters (such as < or %) were changed before being saved.
- Fix: the rules were duplicated when reactivating the plugin, and were not removed from .htaccess files with Windows line endings.
- Fix: uninstalling the plugin now also removes the rules from .htaccess.
- Fix: the global ErrorDocument 401/403 rules no longer affect the rest of the site.
- Security: web access to the folder that stores the password file is now blocked.
- Improvement: the plugin no longer touches the file system on every page load.
- Tested with WordPress 7.1 and PHP 8.2.
- Initial release.