MSC Stealth Login

Install and activate the plugin, go to Settings → MSC Stealth Login, and set a custom login slug (e.g. my-secret-door ). Save — your login page now lives at yoursite.com/my-secret-door and wp-login.php no longer works for visitors. Bookmark the new URL and the Emergency Recovery URL immediately.

They are silently redirected (HTTP 302) to a URL you choose — the homepage by default. There’s no error page revealing that a protection plugin is running. Logged-in users, logout/password-reset flows, and AJAX requests keep working normally.

Enable “Hide wp-admin” on the Settings tab. Logged-out visitors who try to open any /wp-admin URL are silently redirected to a URL you choose (your homepage by default), while logged-in users and AJAX requests are unaffected. Combined with the custom login URL, this hides both your login page and your admin area from bots and vulnerability scanners.

Use the Emergency Recovery URL shown on the Settings tab — copy or bookmark it when you set up the plugin (you can also email yourself the login URL from the Support tab). The recovery URL always reaches wp-login.php. If you lose both, rename the plugin folder via FTP/SFTP or run wp plugin deactivate msc-stealth-login — deactivating instantly restores the standard login page.

Wait for the lockout period to expire, or use the Emergency Recovery URL. For immediate access, disable the plugin via FTP by renaming the plugin folder. Your IP can also be added to the allowlist if you have database access.

Enable Advanced Security Features on the Advanced tab (it ships disabled so nothing surprises you). Then, after the configured number of failed attempts (default 3) from one IP, that IP is locked out for the configured duration (default 15 minutes). Optional progressive lockouts double the wait after each repeat offence, capped at your configured maximum. Successful logins reset the counter.

Yes. Add exact IPs or CIDR ranges (IPv4 and IPv6) to the whitelist on the Advanced tab. Behind Cloudflare or a reverse proxy? Enable “Trust Proxy Headers” so the plugin sees real visitor IPs instead of the proxy’s.

Yes. Activate it network-wide or per site — either way every site gets its own custom login URL, settings, login history and emergency recovery URL, and sites created later are set up automatically. Each site’s administrator configures it under Settings → MSC Stealth Login on their own site. By default failed-login counters are per site; enable “Share Lockouts Across Network” on the Advanced tab if you want a lockout earned on one site to apply across the whole network. Uninstalling removes the plugin’s data from every site on the network.

Yes, both are on by default once Advanced Security is enabled. XML-RPC pingback and user-listing methods are disabled, and the REST API user endpoints plus ?author=N queries are blocked. Note: disabling XML-RPC affects the WordPress mobile app and some Jetpack features — leave it off if you use those.

Yes, but ensure your login pages aren’t cached — exclude your custom login URL from caching. The plugin detects six major cache/security plugins (W3 Total Cache, WP Super Cache, WP Rocket, Wordfence, iThemes Security, Sucuri) and shows a heads-up notice when one is active.

Generally yes, but avoid overlapping features — if another plugin also limits login attempts or hides the login page, disable that feature in one of the two. Test on staging before production.

WooCommerce’s My Account login page is separate and keeps working. The plugin protects wp-login.php and wp-admin; test your specific checkout/membership flows on staging.

Navigate to Settings → MSC Stealth Login → Email tab. Enable the notifications you want and customize the subject and body using placeholders: {ip} , {attempts} , {time} , {site_name} , {site_url} . Notifications are sent immediately when events occur.

Login attempts (IP, username, result, user agent, timestamp) are stored in your own database only — nothing is sent externally and there are no cookies or third-party requests. History is clearable from the History tab, auto-pruned after 30 days, and the table is removed completely on uninstall.

No. Every feature is included in the plugin you download — there is nothing to unlock and no separate paid add-on.