內容簡介
Protect WP Login 是一款為 WordPress 登入頁面增加第二層密碼保護的外掛，透過 HTTP 基本認證來防止機器人和暴力破解攻擊，確保網站安全。
【主要功能】
• 在 wp-login.php 上實施伺服器級別的密碼保護
• 可選擇保護 xmlrpc.php，防範暴力攻擊
• 啟用時自動生成隨機使用者名稱和密碼
• 狀態面板顯示保護是否啟用
• 支援無限使用者管理，從 WordPress 控制台操作
外掛標籤
開發者團隊
② 後台搜尋「Protect WP Login – Password Protect wp-login.php with Basic Auth」→ 直接安裝（推薦）
原文外掛簡介
Protect WP Login adds a second password in front of your WordPress login page. Before the login form is shown, the web server asks for an extra username and password (HTTP Basic Authentication through .htaccess). Bots and brute force attacks are rejected by the server, so they never reach WordPress, PHP or your database.
Why protect wp-login.php at the server level?
Every request to wp-login.php loads WordPress and queries the database, even when it comes from a bot trying thousands of passwords. Plugins that limit login attempts or add a CAPTCHA still have to do that work for every attempt. With Protect WP Login the server rejects those requests before WordPress starts:
Brute force bots don’t consume PHP or database resources.
Attackers never see your login form, so they can’t try WordPress passwords.
No CAPTCHA to solve and no extra scripts on the login page.
It works together with Wordfence, Limit Login Attempts, two-factor authentication and other security plugins: it’s one more layer in front of them.
Features
Password protects wp-login.php with server-level HTTP Basic Authentication.
Optionally protects xmlrpc.php, another common target of brute force attacks.
Creates a random username and password on activation, and keeps them visible until you confirm you saved them.
Checks the protection right after writing the rules. If your hosting doesn’t support them, they are removed automatically so your site keeps working.
Status panel that shows whether the protection is really active.
Password protected posts keep working for your visitors.
Unlimited users, managed from the WordPress admin.
Translated into English, Spanish, German, French, Italian and Portuguese.
How it works
A visitor or a bot opens wp-login.php.
The web server asks for the extra username and password managed by the plugin.
Only with the right credentials the usual WordPress login form is shown. Wrong credentials are rejected by the server.
Requirements
Apache or LiteSpeed web server with .htaccess support (most shared hosting). On Nginx, the plugin shows the configuration to add to the server.
Single site installations. WordPress Multisite is not supported yet.
