WP Login Door
Adds a secret URL key to access the login page and lets you disable XML-RPC, protecting against bruteforce attacks.
Use with caution
WP Login Door works, but test it on a staging site before relying on it in 2026. It runs on 400+ sites, is rated 5/5 and was last updated 1 year ago, and scores 48/100 on our health check.
- Small user base (400+ active installs)
- No update in over a year
- Only tested up to WordPress 6.8 (latest is 7.1)
How does it stack up?
Side-by-side on installs, updates, ratings & support
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where WP Login Door stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| BruteForce | #3 |
| hide | >100 |
| login | >100 |
| security | >100 |
| xmlrpc | #21 |
Version adoption
Share of active sites per release.
Rating breakdown
★★★★★★★★★★ 5 from 6 reviews
About WP Login Door
From the official readme · v1.5Description
Did you ever feel like your website or blog login page is ridiculously fragile and reachable, and could be easily broken in by an intruder?
Personally I hate to think of hundreds of people playing with my door lock hundreds of times a day. It’s the same with my blog login page.
On WordPress, there are two main potential vectors of bruteforce intrusion:
* http://my-site.com/wp-login.php, which is the login page
* http://my-site.com/xmlrpc.php, which is an API gateway for interacting with third party applications.
This plugin adds one security layer in front of your login page, and by the way you can also disable XML-RPC with a simple checkbox if you don’t need it (XML-RPC is a WIDELY used vector of attacks).
The idea is simple: you choose a pair of words, and when you want to access your login page, you just have to provide them in the URL like this: http://my-site.com/wp-login.php?word1=word2. That’s all!
If you try to access your login page without this pair of words, you get a configurable error message, where you can insult the attacker as much as you want 😉
Installation
- Upload the plugin files to the
/wp-content/plugins/wp-login-doordirectory, or install the plugin through the WordPress plugins screen directly. - Activate the plugin through the ‘Plugins’ screen in WordPress
- Use the Settings->Wp Login Door screen to configure the plugin
- Enjoy your new door 🙂
Frequently asked questions
What if I lose my pair of words?
You can disable the plugin from your FTP server. Then login as usual, reactivate the plugin, and check your word pair.
Is that free?
I don’t know if the beerware license is GPL 2 compatible, but if you like this plugin and if we meet someday, you can buy me a beer.
Is that all ?
Yes!
Changelog
1.5
- Let go the ‘postpass’ standard action (used when user types a password to open a protected post)
1.4
- Removed some php notices in the administration section.
1.1.1
- Bug correction. During refactoring, I misspelled the key name sanitization callback, and it could cause problems on some installations, such as key name field not stored.
1.1
- Added a new setting to redirect home instead of displaying an error message.
1.0
- First release
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
Best WP Login Door alternatives
All BruteForce plugins →
FAQ
WP Login Door: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Oct 5, 2026
Is WP Login Door free?
Yes. WP Login Door is free to download and use from the official WordPress.org plugin directory.
Is WP Login Door safe to use in 2026?
WP Login Door works, but test it on a staging site before relying on it in 2026. It runs on 400+ sites, is rated 5/5 and was last updated 1 year ago, and scores 48/100 on our health check.
How many websites use WP Login Door?
WP Login Door is active on 400+ WordPress websites and has been downloaded 4,987 times since it launched in August 2016. It was downloaded 126 times in the last 30 days.
Does WP Login Door work with WordPress 7.1?
WP Login Door is officially tested up to WordPress 6.8.10, while the latest release is 7.1.2. It may still work, but try it on a staging site first.
When was WP Login Door last updated?
The latest version, 1.5, was released on June 11, 2025 (1 year ago).
Who makes WP Login Door?
WP Login Door is developed and maintained by toxnico.
What are the best alternatives to WP Login Door?
The most popular alternatives to WP Login Door are Security-Protection (300+ installs), BruteGuard (100+ installs) and WP-DenyHosts (10+ installs).
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
