FAQ SOP: Does renaming /wp-admin actually protect me?

FAQ SOP: Does renaming /wp-admin actually protect me?

Short answer: no, on its own. Here is the procedure that does work.

— Step 1: Skip plugins that "hide" wp-login.php. They break REST and Site Health, and bots find the new URL via redirects.
— Step 2: Instead, rate-limit at the edge. Block more than 5 POSTs to wp-login.php per IP per 5 minutes.
— Step 3: Add HTTP auth on wp-login.php in nginx: location = /wp-login.php { auth_basic "x"; }.
— Step 4: Allowlist your office and VPN IPs for /wp-admin if static.
— Step 5: Verify: from a clean network, confirm you hit the basic-auth prompt before WordPress loads.

Obscurity delays scanners. Auth stops them.

Run this every time.