Defyn Security Manager WordPress Plugin

Q: How do I hide the WordPress login page?

Activate the plugin, open Defyn Security, Settings , and enter a custom slug for your login URL. From then on your login page lives at that secret address, and /wp-admin and /wp-login.php return a 404, a redirect, or a decoy screen, whichever you choose.

Q: I have locked myself out. How do I recover?

The fastest fix is to add this line to wp-config.php : define( 'DEFYN_BEM_DISABLE', true ); This bypasses all login interception so /wp-admin and /wp-login.php work normally again. A yellow admin notice reminds you to remove the line once you are back in. Your settings and 2FA data are kept. If you cannot edit wp-config.php , rename the plugin folder over SFTP from defyn-security-manager to defyn-security-manager.disabled . WordPress deactivates the plugin on the next page load. Rename it back when you are ready to re-enable.

Q: Does it work behind Cloudflare or a load balancer?

Yes. Define DEFYN_BEM_TRUST_PROXY in wp-config.php so the plugin honours X-Forwarded-For and CF-Connecting-IP headers when detecting the visitor IP address.

Download Trends

Loading download data…

Vulnerabilities

✓

No known vulnerabilities

This plugin has no records in the Wordfence Intelligence vulnerability database.

About Defyn Security Manager

Hide wp-admin behind a custom login URL and stop brute-force attacks with two-factor authentication, login limits, IP rules and an activity log.

Defyn Security Manager is a lightweight WordPress security plugin that hides your login page and locks down the back end. Most attacks on WordPress start at one predictable place: /wp-admin and /wp-login.php. Defyn Security Manager moves that door, throttles attackers, adds two-factor authentication, and records every attempt so you always know who is knocking.

No bloat, no upsell walls, and no account required. Install it, choose a secret login slug, and your login page disappears from bots and scanners.

What it does

Hide the WordPress login URL. Replace /wp-admin and /wp-login.php with any custom login URL you choose, so automated bots and brute-force scripts hit a dead end.
Decoy or 404 the old URLs. Decide what attackers see at the original login addresses: a 404, a redirect, or a decoy login screen.
Brute-force protection. Limit login attempts and automatically lock out IP addresses after repeated failures, with a one-click control to clear active lockouts.
Two-factor authentication (2FA). Add TOTP-based two-factor authentication using Google Authenticator, Authy, 1Password, Microsoft Authenticator or Bitwarden, complete with backup codes and per-role enforcement.
REST API and XML-RPC protection. Extend two-factor enforcement to the REST API and XML-RPC, with optional API hiding to shrink your attack surface.
Time-window access control. Only allow logins during the hours and days you actually work, and block everything else.
IP allowlisting. Optionally restrict back-end access to trusted IP addresses or CIDR ranges.
Activity log and audit trail. See login attempts, lockouts, scans of your old login URLs, and settings changes in one searchable log.
Email alerts. Get notified about lockouts, scans, and logins from new IP addresses.

Why choose Defyn Security Manager

Fast and focused. A purpose-built login-security and login-hardening plugin, not a heavyweight suite that slows your site down.
Recovery built in. A documented emergency kill switch means you can never permanently lock yourself out.
Privacy friendly. Your data stays on your site. Nothing is sent to a third-party service.
Built by an agency. Maintained by Defyn, an Australian web design and development studio that runs this plugin on client sites every day.

Defyn Security Manager is ideal for anyone who wants to hide wp-admin, stop brute-force login attempts, limit login attempts, add 2FA to WordPress, and keep a clear security audit trail.

Frequently Asked Questions

How do I hide the WordPress login page?

Activate the plugin, open Defyn Security, Settings, and enter a custom slug for your login URL. From then on your login page lives at that secret address, and /wp-admin and /wp-login.php return a 404, a redirect, or a decoy screen, whichever you choose.

I have locked myself out. How do I recover?

The fastest fix is to add this line to wp-config.php:

define( 'DEFYN_BEM_DISABLE', true );

This bypasses all login interception so /wp-admin and /wp-login.php work normally again. A yellow admin notice reminds you to remove the line once you are back in. Your settings and 2FA data are kept.

If you cannot edit wp-config.php, rename the plugin folder over SFTP from defyn-security-manager to defyn-security-manager.disabled. WordPress deactivates the plugin on the next page load. Rename it back when you are ready to re-enable.

Does it work behind Cloudflare or a load balancer?

Yes. Define DEFYN_BEM_TRUST_PROXY in wp-config.php so the plugin honours X-Forwarded-For and CF-Connecting-IP headers when detecting the visitor IP address.

Which authenticator apps work with the 2FA feature?

Any app that supports standard RFC 6238 TOTP, including Google Authenticator, Authy, 1Password, Microsoft Authenticator and Bitwarden.

Will hiding the login URL break my site or REST API?

No. Front-end pages, the REST API and normal site behaviour keep working. Only the human login entry points move, and you can layer two-factor enforcement on top of the REST API and XML-RPC separately.

Does it slow down my website?

No. The plugin only runs its checks on login and admin requests, so it has no measurable impact on front-end page speed.

Can I use it on a multisite network?

This release supports single-site activation only. Network-wide multisite support is on the roadmap.

Ratings & Reviews

Recent Reviews

Loading reviews…

View all reviews on WordPress.org (opens in a new tab)

Changelog

1.2.1

Fixed: brute-force counter updates now use portable SQL (CASE WHEN) so SQLite-backed WordPress installs (Playground, Studio) count attempts correctly.
Fixed: PHP warnings from wp-login.php globals when rendering the hidden login page.
Fixed: blank page after 2FA verification when no redirect destination was set; now lands on the dashboard.

1.2.0

Added: site activity logging in the Activity Log – content publishes, edits and deletions, media uploads, plugin and theme changes, user management, and core, plugin and theme updates. On by default with 30-day retention, so no separate audit-log plugin is needed.
Added: TOTP replay protection – each two-factor code is accepted once.
Security: 2FA secrets are now encrypted at rest, and secrets are no longer stored for users who never complete enrolment.
Security: a successful login now only clears the lockout counter for the account that was failing; logins to other accounts just decrement it.
Added: the emergency bypass code can be entered in a login-form field instead of the URL query string.
Fixed: blocked-request handling now runs later in the load order, so theme 404 templates and login-form plugins registered on init work correctly.
Fixed: failed-attempt counting is atomic and stale rows are cleaned up daily.
Fixed: REST API detection anchors to the REST prefix instead of matching any URL containing wp-json.
Fixed: “new IP” alerts no longer re-fire after log retention prunes old entries.
Fixed: scan alert emails name the actual blocked endpoint.

1.1.1

Fixed: saving a user profile failed with “The link you followed has expired”. The 2FA enrollment box rendered its nonce with the default field name, which overwrote the core user-edit nonce.
Fixed: the same nonce collision from the “Clear all lockouts” button broke saving the Security tab while a lockout was active.
Fixed: fatal TypeError when saving a settings tab with every checkbox unchecked, for example when disabling two-factor authentication.
Fixed: saving one settings tab no longer resets the other tabs to their defaults, and unchecking a checkbox whose default is on now persists.

1.1.0

Added: two-factor enforcement for the REST API and XML-RPC.
Added: opt-in API hiding to reduce the attack surface.
Added: “Clear lockouts” control in the admin UI.
Fixed: authentication filters now run at priority 95 and 96 so a WP_Error survives the full filter chain.
Fixed: login URL interception now hooks on setup_theme instead of plugins_loaded for more reliable behaviour.