Myth-Busting SOP: Renaming wp-login.php Is Real Security

Myth-Busting SOP: Renaming wp-login.php Is Real Security

The claim: move /wp-admin to a secret slug and bots can't find you. Wrong — it's obscurity, not access control. Correction procedure:

— Step 1: Keep the rename if you want quieter logs, but never count it as a control.
— Step 2: Enforce 2FA on every account with admin or editor role. This is the actual gate.
— Step 3: Add a login lockout (5 fails, 20-min ban) at the application layer.
— Step 4: Rate-limit POST to the login endpoint at your WAF or nginx, not just GET.
— Step 5: Verify by attempting credential-stuffing against your secret URL — if 2FA stops you, you're covered; if only the slug stops you, you're not.

Obscurity buys time, never trust. Run this every time.