Title: Protect WP Login – Password Protect wp-login.php with Basic Auth
Author: Click.ar
Published: <strong>25 September 2024</strong>
Last modified: 14 October 2026

---

Search plugins

![](https://ps.w.org/protect-wp-login/assets/banner-772x250.png?rev=3163255)

![](https://ps.w.org/protect-wp-login/assets/icon-256x256.png?rev=3157850)

# Protect WP Login – Password Protect wp-login.php with Basic Auth

 De [Click.ar](https://profiles.wordpress.org/clickar/)

[Download](https://downloads.wordpress.org/plugin/protect-wp-login.1.1.2.zip)

 * [Details](https://lij.wordpress.org/plugins/protect-wp-login/#description)
 * [Reviews](https://lij.wordpress.org/plugins/protect-wp-login/#reviews)
 *  [Installation](https://lij.wordpress.org/plugins/protect-wp-login/#installation)
 * [Development](https://lij.wordpress.org/plugins/protect-wp-login/#developers)

 [Supòrto](https://wordpress.org/support/plugin/protect-wp-login/)

## Description

Protect WP Login adds a second password in front of your WordPress login page. Before
the login form is shown, the web server asks for an extra username and password (
HTTP Basic Authentication through `.htaccess`). Bots and brute force attacks are
rejected by the server, so they never reach WordPress, PHP or your database.

### Why protect wp-login.php at the server level?

Every request to `wp-login.php` loads WordPress and queries the database, even when
it comes from a bot trying thousands of passwords. Plugins that limit login attempts
or add a CAPTCHA still have to do that work for every attempt. With Protect WP Login
the server rejects those requests before WordPress starts:

 * Brute force bots don’t consume PHP or database resources.
 * Attackers never see your login form, so they can’t try WordPress passwords.
 * No CAPTCHA to solve and no extra scripts on the login page.
 * It works together with Wordfence, Limit Login Attempts, two-factor authentication
   and other security plugins: it’s one more layer in front of them.

### Features

 * Password protects `wp-login.php` with server-level HTTP Basic Authentication.
 * Optionally protects `xmlrpc.php`, another common target of brute force attacks.
 * Creates a random username and password on activation, and keeps them visible 
   until you confirm you saved them.
 * Checks the protection right after writing the rules. If your hosting doesn’t 
   support them, they are removed automatically so your site keeps working.
 * Status panel that shows whether the protection is really active.
 * Password protected posts keep working for your visitors.
 * Unlimited users, managed from the WordPress admin.
 * Translated into English, Spanish, German, French, Italian and Portuguese.

### How it works

 1. A visitor or a bot opens `wp-login.php`.
 2. The web server asks for the extra username and password managed by the plugin.
 3. Only with the right credentials the usual WordPress login form is shown. Wrong 
    credentials are rejected by the server.

### Requirements

 * Apache or LiteSpeed web server with `.htaccess` support (most shared hosting).
   On Nginx, the plugin shows the configuration to add to the server.
 * Single site installations. WordPress Multisite is not supported yet.

## Screenshots

[⌊Status panel: the protection is active, with the XML-RPC option and the list of
users.⌉⌊Status panel: the protection is active, with the XML-RPC option and the 
list of users.⌉[

Status panel: the protection is active, with the XML-RPC option and the list of 
users.

[⌊The username and password generated on activation stay visible until you confirm
you saved them.⌉⌊The username and password generated on activation stay visible 
until you confirm you saved them.⌉[

The username and password generated on activation stay visible until you confirm
you saved them.

[⌊A reminder is shown on the dashboard until the generated credentials are saved.⌉⌊
A reminder is shown on the dashboard until the generated credentials are saved.⌉[

A reminder is shown on the dashboard until the generated credentials are saved.

[⌊The browser asks for the extra username and password before showing wp-login.php.⌉⌊
The browser asks for the extra username and password before showing wp-login.php
.⌉[

The browser asks for the extra username and password before showing wp-login.php.

[⌊After the extra authentication, the usual WordPress login form appears.⌉⌊After
the extra authentication, the usual WordPress login form appears.⌉[

After the extra authentication, the usual WordPress login form appears.

[⌊Adding a new user. The list shows all the users that can pass the extra authentication.⌉⌊
Adding a new user. The list shows all the users that can pass the extra authentication
.⌉[

Adding a new user. The list shows all the users that can pass the extra authentication.

[⌊If the hosting doesn't support the rules, they are removed automatically and the
panel explains why.⌉⌊If the hosting doesn't support the rules, they are removed 
automatically and the panel explains why.⌉[

If the hosting doesn’t support the rules, they are removed automatically and the
panel explains why.

## Installation

 1. Install the plugin from ‘Plugins > Add New Plugin’, or upload the plugin files 
    to the `/wp-content/plugins/protect-wp-login` directory.
 2. Activate the plugin through the ‘Plugins’ menu in WordPress.
 3. You will be taken to the ‘Protect WP Login’ page, where the generated username 
    and password are shown. **Save them** before logging out, or create your own users
    on the same page.

## FAQ-e

### How is it different from other login security plugins?

Plugins like Wordfence or Limit Login Attempts check each login attempt inside WordPress,
after it has loaded. Protect WP Login blocks the request at the web server, before
WordPress loads, so bots don’t use your server resources. You can use both: Protect
WP Login is an extra layer in front of your security plugin.

### I got locked out. How do I get back in?

Connect to your site by FTP or with the file manager of your hosting, open the `.
htaccess` file in the WordPress folder and delete the lines between `# BEGIN Protect
WP Login` and `# END Protect WP Login`. You can also rename the `wp-content/plugins/
protect-wp-login` folder to deactivate the plugin.

### Will it work on my hosting?

It works on Apache and LiteSpeed servers that allow `.htaccess` files, which covers
most shared hosting. After writing the rules the plugin checks your site: if the
server answers with an error, the rules are removed automatically and the status
panel explains what happened.

### Does it work on Nginx?

Nginx doesn’t read `.htaccess` files. The plugin page shows the configuration you(
or your hosting provider) have to add to the Nginx server to protect `wp-login.php`
with the same users.

### Do password protected posts still work?

Yes. Visitors can still unlock password protected posts and pages without knowing
the extra credentials.

### Should I also protect xmlrpc.php?

If you don’t use Jetpack, the WordPress mobile app or another service that publishes
through XML-RPC, enabling it blocks another common entry point for brute force attacks.

### Do I need to enter the extra password every time?

Browsers remember Basic Authentication credentials during the session, and most 
of them (Chrome, Firefox, Edge, Safari) offer to save them like any other password,
so you don’t have to type them again.

### How do I add or delete users?

Go to the ‘Protect WP Login’ page in the admin menu. Enter a username and password
and click ‘Save’ to add a user, or click ‘Delete’ next to an existing user. There
is always at least one user.

### Do I need a complex username and password?

A simple combination is enough to stop bots, because they are blocked before reaching
WordPress. The password can’t be the same as the username.

### Is it secure without HTTPS?

Basic Authentication sends the credentials in every request to `wp-login.php`, just
like the WordPress login form. Use HTTPS (free with Let’s Encrypt on most hosting)
to keep them private.

## Reviews

There are no reviews for this plugin.

## Contributors & Developers

“Protect WP Login – Password Protect wp-login.php with Basic Auth” is open source
software. The following people have contributed to this plugin.

Contributors

 *   [ Click.ar ](https://profiles.wordpress.org/clickar/)
 *   [ Alexis Buonasena ](https://profiles.wordpress.org/alebuo/)

“Protect WP Login – Password Protect wp-login.php with Basic Auth” has been translated
into 2 locales. Thank you to [the translators](https://translate.wordpress.org/projects/wp-plugins/protect-wp-login/contributors)
for their contributions.

[Translate “Protect WP Login – Password Protect wp-login.php with Basic Auth” into your language.](https://translate.wordpress.org/projects/wp-plugins/protect-wp-login)

### Interested in development?

[Browse the code](https://plugins.trac.wordpress.org/browser/protect-wp-login/),
check out the [SVN repository](https://plugins.svn.wordpress.org/protect-wp-login/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/protect-wp-login/)
by [RSS](https://plugins.trac.wordpress.org/log/protect-wp-login/?limit=100&mode=stop_on_copy&format=rss).

## Changelog

#### 1.1.2

 * Translations: the plugin name is no longer translated, and Spanish uses the informal
   form, following the WordPress.org translation style guides.

#### 1.1.1

 * New: interface translated into Spanish, German (formal and informal), French,
   Italian and Portuguese (Brazil and Portugal). Regional variants, such as Spanish
   from Argentina or Mexico, use the closest translation.
 * New: link to leave a review on the plugin page.
 * Improved description, FAQ and screenshots.
 * Updated plugin and author URLs.

#### 1.1

 * New: the generated credentials stay visible until you confirm you saved them (
   before, they disappeared after 60 seconds).
 * New: automatic check after writing the rules. If the server returns an error 
   500, the rules are removed so the site keeps working.
 * New: status panel with the protection state and a “Check again” button.
 * New: option to also protect xmlrpc.php.
 * New: instructions for Nginx servers.
 * Fix: password protected posts asked visitors for the extra credentials.
 * Fix: passwords with special characters (such as < or %) were changed before being
   saved.
 * Fix: the rules were duplicated when reactivating the plugin, and were not removed
   from .htaccess files with Windows line endings.
 * Fix: uninstalling the plugin now also removes the rules from .htaccess.
 * Fix: the global ErrorDocument 401/403 rules no longer affect the rest of the 
   site.
 * Security: web access to the folder that stores the password file is now blocked.
 * Improvement: the plugin no longer touches the file system on every page load.
 * Tested with WordPress 7.1 and PHP 8.2.

#### 1.0

 * Initial release.

## Mêta

 *  Version **1.1.2**
 *  Last updated **3 days ago**
 *  Active installations **Fewer than 10**
 *  WordPress version ** 6.0 or higher **
 *  Tested up to **7.1.3**
 *  PHP version ** 7.4 or higher **
 *  Languages
 * [English (US)](https://wordpress.org/plugins/protect-wp-login/), [Spanish (Argentina)](https://es-ar.wordpress.org/plugins/protect-wp-login/),
   e [Spanish (Mexico)](https://es-mx.wordpress.org/plugins/protect-wp-login/).
 *  [Translate into your language](https://translate.wordpress.org/projects/wp-plugins/protect-wp-login)
 * Tags
 * [Basic auth](https://lij.wordpress.org/plugins/tags/basic-auth/)[Brute Force](https://lij.wordpress.org/plugins/tags/brute-force/)
   [htaccess](https://lij.wordpress.org/plugins/tags/htaccess/)[login](https://lij.wordpress.org/plugins/tags/login/)
   [security](https://lij.wordpress.org/plugins/tags/security/)
 *  [Advanced View](https://lij.wordpress.org/plugins/protect-wp-login/advanced/)

## Ratings

No reviews have been submitted yet.

[Your review](https://wordpress.org/support/plugin/protect-wp-login/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/protect-wp-login/reviews/)

## Contributors

 *   [ Click.ar ](https://profiles.wordpress.org/clickar/)
 *   [ Alexis Buonasena ](https://profiles.wordpress.org/alebuo/)

## Supòrto

Got something to say? Need help?

 [View support forum](https://wordpress.org/support/plugin/protect-wp-login/)