Hiding the login page and limiting attempts stop most attacks on WordPress. The trouble comes later: you forget the address or lock yourself out, and the usual fix is "rename the plugin folder over FTP". Bawwab emails you the address and a one-time unlock link.
The address and a one-time unlock link, no FTP or database.
Bots looking for wp-login.php get "not found".
After a few wrong passwords the address is locked, even with the right one.
Know right away if your account logs in from somewhere new.
A stolen password alone isn't enough, with no code on your usual devices.
Works right-to-left and left-to-right, with an Arabic translation.
instead of WP Ghost
Open yoursite.com/?bawwab_recover and enter the admin email; you'll get the address and an unlock link.
Yes. Tick "behind Cloudflare" so lockouts use the visitor's real address.
Free has hiding, recovery, lockouts and alerts. Pro adds the email code, allowed addresses, lockout emails and log export.
Try Pro free for 7 days with no card, and get a refund within 14 days if it doesn't suit you.