Image 1 / 11
NewMove your login to a private URL, limit failed logins, harden common leaks, send security headers and keep an audit log. Built-in recovery paths.
Wardgate - Login Shield & Security Hardening — Hide the WordPress login, stop password guessing and tidy up information leaks, with four independent recovery paths.
Wardgate moves your WordPress login to a private address, answers visitors who poke at wp-login.php or wp-admin with a plain 404, locks out addresses that keep guessing passwords and switches off a handful of well known information leaks. A searchable audit log shows who logged in, who failed and what was blocked.
Changing a login URL is risky, so Wardgate is built around safe recovery. It tests the new address before it saves it, asks you to confirm that you stored the link, never edits .htaccess or wp-config.php, and gives you four independent ways back in: the private address, an emergency recovery link, a one-line constant in wp-config.php and simply renaming the plugin folder.
Enabling the private login. Login URL tab: choose a slug (letters, numbers and hyphens), switch the feature on and confirm that you saved the address. Slugs must be 4 to 40 characters. Wardgate refuses slugs that are reserved by WordPress or already used by a page, post or term.
What visitors see. Logged-out visitors who open /wp-login.php, /wp-admin or /wp-register.php get your theme's 404 page (or a redirect). The built-in WordPress shortcuts /login, /admin and /dashboard are stopped from forwarding visitors to the real login. admin-ajax.php, admin-post.php, the REST API and wp-cron keep working.
If you are locked out. 1) Open the private address. 2) Open https://your-site/wp-login.php?wardgate_recover=YOUR_KEY for a one-hour recovery cookie. 3) Add define( 'WARDGATE_DISABLE', true ); above "That's all, stop editing!" in wp-config.php. 4) Rename wp-content/plugins/wardgate-login-shield, or run wp plugin deactivate wardgate-login-shield.
Brute-force limits. Protection tab: after the chosen number of failures inside the time window an address is locked for the chosen duration, even if the correct password is then used. Allowlisted addresses are never locked. Active locks appear on the Overview with a Release button.
Reverse proxies. If your site is behind a trusted proxy or CDN switch on "Trust proxy headers" so the visitor address is read from the forwarded header. Leave it off otherwise, because the header can be forged.
Audit log. Audit log tab: filter by event, page through entries, export CSV or clear the log. IP addresses are anonymised by default and entries are removed after the retention period by a daily scheduled job.
wardgate-login-shield), organised in namespaced PHP classesreadme.txt in WordPress.org format, a full HTML documentation page in docs/ and a CHANGELOG.mdlicense.txt (GNU GPL v2) and a translation template in languages/The gallery shows the plugin running on a private test site ("Fieldnotes") with sample posts and sample statistics, not a public demo. There is no hosted live demo for this plugin.
Third-party product and network names mentioned are trademarks of their respective owners. This plugin is an independent product and is not affiliated with or endorsed by them.
Additional package and setup details from the author. The purchase options and marketplace license terms govern your order.
The plugin source is licensed under the GNU General Public License v2 or later (see license.txt), as for every WordPress plugin. What you buy here is the packaged, supported release: the download, updates published on this listing and author support through the marketplace.
These marketplace licence terms describe who the support and update entitlement covers. They do not take away the rights the GPL grants you.
Tags: Security Login Brute Force Hide Login Wp Login Audit Log Hardening
Browse more in Plugins, or see all items by Fernwick Studio.
Common questions about this listing.
Wardgate is built to make that very unlikely. It tests the new address before saving, asks you to confirm you stored it, never edits .htaccess or wp-config.php, and offers four independent ways back in. Deactivating the plugin, or renaming its folder, restores the normal login immediately.
Use the emergency recovery link from the Recovery tab, add the WARDGATE_DISABLE constant to wp-config.php, rename the plugin folder over FTP, or run wp plugin deactivate wardgate-login-shield.
Yes. The login screen is sent with no-cache headers. If your cache plugin has a "never cache these URLs" list, add your private login slug to it.
Front-end login forms that post to the standard login endpoints keep working and are covered by the lock-out rules. Wardgate rewrites the login, logout and lost-password links that WordPress generates.
No. Those endpoints stay reachable for visitors, so themes, forms and scheduled tasks keep working.
Failed logins are counted per IP address inside the time window you choose. Reaching the limit locks that address for the duration you choose. Locked addresses are refused even with the right password until the lock expires or you release it.
The connection address by default. Behind a trusted proxy or CDN switch on "Trust proxy headers" to use the forwarded address.
The audit log holds the username that was typed, the event and the IP address, which is anonymised by default. Entries are deleted automatically after the retention period. You can switch the log off.
No. Wardgate focuses on hiding the login, rate limiting and hardening. It works alongside plugins that add two-factor authentication.
Yes, all text is translatable and a .pot file is included.
By default the settings, the audit-log table, lock data and scheduled job are removed. You can keep them by switching off "Delete all Wardgate data when the plugin is deleted" (Hardening tab). Deactivating never deletes anything.
Wardgate 1.0 is built and tested for single-site installs. Multisite networks are not officially supported yet.
Release notes for this item, newest first.
Current v1.0.0
v1.0.0
CurrentLog in after purchase to download version files.
4.0
1 review
Only people who bought this item can review it, which keeps ratings honest. Sign in if you already bought it.
Theo Lang Reviewed v1.0.0
Put this on a client brochure site. The private login slug, the 404 for wp-login.php, and the brute-force lockouts with an IP allowlist are what I turned on first. The pre-flight check that requests the new address before saving it is the reason I trusted the change. The audit log and CSV export are there; I have not needed the emergency cookie yet, but the four recovery paths are documented in the settings.
Ask the seller about setup, compatibility or customisation before you buy.
Sign in to ask the seller a question.
No questions yet
Be the first to ask. Answers from the seller appear right here.
Small, privacy-minded WordPress plugins
Fernwick Studio Verified New
Fernwick Studio builds small, focused WordPress plugins that stay fast and respect visitor privacy: no trackers, no phoning home, no jQuery unless it is really needed. Every plugin is original work released under the GPL v2 or later, built with the WordPress coding standards and tested on current WordPress releases and PHP 8.2.
Plugins
Live estimate forms with conditional questions, a server-checked total, and an entries inbox. No external service.
Regular license price USD 39.00
New listing Updated
Plugins
A coming-soon or maintenance page, private preview links, and a launch checklist. Visitors are held; you are not.
Regular license price USD 29.00
New listing Updated
Plugins
Create announcement bars, popups and slide-ins with countdowns, scheduling, targeting, frequency control and private local stats. No jQuery.
Regular license price USD 24.00
New listing Updated
Plugins
Lightweight social share buttons and follow icons with blocks, shortcodes, floating and mobile bars, and private local click stats.
Regular license price USD 19.00
New listing Updated
Media management
Nested, colour-coded folders for the Media Library with drag and drop, bulk move, a media picker filter and a gallery block and shortcode.
Regular license price USD 39.00
New listing Updated
Themes
A fast block theme (Full Site Editing) for game-server communities, clans and streamers. 59 patterns, 6 style variations, demo content, no page builder, no required plugins, no jQuery.
Regular license price USD 49.00
New listing Updated
Pick up where you left off
Your last discoveries, saved only in this browser.
Wardgate — Login Shield & Security Hardening
USD 29.00
