FluentAuth: hide wp-admin
hi Shahjahan Jewel , question, it is recomended to hide the wp-admin and wp-login page to prevent hackers to easily find it.
I'm using https://wordpress.org/plugins/wps-hide-login/ to do this, but would prefer to see this option in FluentAuth.
Is something like this on the roadmap?
Hiding the login URL is not really a security fix. It is a noise fix.
The login form itself is not the weak point. Even with the URL hidden, someone can still hit the REST API or xmlrpc.php to try passwords. The custom slug also leaks in password reset emails, login links in comments, referrer headers and a few other places. So a targeted attacker finds it pretty fast.
What it does do well is stop the dumb bots that hammer wp-login.php all day. Less server load, cleaner logs, fewer lockout emails. That is a real benefit, just not the one most people think they are buying.
The things that actually stop these attacks are rate limiting, 2FA, passkeys, blocking user enumeration and handling xmlrpc properly. FluentAuth already covers a good part of that.
So it is not something we are building right now. WPS Hide Login does the job fine for the bot noise but it does not help you with security.
Shahjahan Jewel thank you for the clarification :-)
Does FluentAuth play well with WPS Hide login?
(did not try it yet, it is for a new customer who wants to use this)
Natascha Vantuykom should work.
Shahjahan Jewel should I install this plugin if I use FluentCommunity or its features are already included in the community plugin?
Ricardo Corai You can use FluentAuth which has great security features for authentication, magic login etc.