# Protect wp-login.php With a Secret Key

> Hides the login page behind a secret link: wp-login.php returns "Not Found" unless you have opened it with your key once in this browser.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: security, login, brute-force
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/protect-login-with-secret-key/

## Code

```php
// Open https://your-site.com/wp-login.php?access=YOUR-SECRET once per browser (remembered for 30 days).
$wpide_login_key_param = 'access';
$wpide_login_key       = 'change-this-to-a-long-random-secret';

add_action( 'login_init', function () use ( $wpide_login_key_param, $wpide_login_key ) {
    $action = isset( $_REQUEST['action'] ) ? sanitize_key( $_REQUEST['action'] ) : 'login';

    // Logout, password-protected posts and password reset links from emails always work.
    if ( is_user_logged_in() || in_array( $action, array( 'logout', 'postpass', 'rp', 'resetpass', 'confirmaction' ), true ) ) {
        return;
    }

    $cookie   = 'wpide_login_access';
    $expected = hash_hmac( 'sha256', $wpide_login_key, wp_salt( 'auth' ) );

    if ( isset( $_GET[ $wpide_login_key_param ] ) && hash_equals( $wpide_login_key, (string) wp_unslash( $_GET[ $wpide_login_key_param ] ) ) ) {
        setcookie( $cookie, $expected, time() + 30 * DAY_IN_SECONDS, SITECOOKIEPATH, COOKIE_DOMAIN, is_ssl(), true );
        return;
    }

    if ( isset( $_COOKIE[ $cookie ] ) && hash_equals( $expected, (string) wp_unslash( $_COOKIE[ $cookie ] ) ) ) {
        return;
    }

    status_header( 404 );
    nocache_headers();
    header( 'Content-Type: text/html; charset=utf-8' );
    echo '<!DOCTYPE html><html><head><title>404 Not Found</title><meta name="robots" content="noindex"></head><body><h1>Not Found</h1></body></html>';
    exit;
} );
```

## Notes

Bookmark the secret link, and if you lose it turn the snippet off from WPIDE safe mode.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Protect wp-login.php With a Secret Key" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/