Can I block URLs that access /wp-login.php?

Hi @megseoh,

Thank you for reaching out.

As explained in the video below, we don’t recommend changing the login URL or blocking access to wp-login/wp-admin.

https://www.wordfence.com/blog/2017/10/should-you-hide-wordpress-login-page/

Wordfence provides a full and complete brute-force login attack prevention solution. See the articles below:

https://www.wordfence.com/help/firewall/brute-force/

https://www.wordfence.com/help/tools/two-factor-authentication/

https://www.wordfence.com/help/login-security/?

Since you mentioned you’re using a plugin to access the site, please confirm that it doesn’t require access to wp-login.php/wp-admin since most of these plugins are built on the WordPress login flow. If not, it’s fine to impose immediate blocks on the default login URL so long as you’re aware it’ll even block you.

Let us know how it goes.

Thanks,

Janet.