Hushfort
Menu

Getting started

Updated

This guide takes you from installing the free plugin to a hidden login page. It takes about five minutes. You need an administrator account and, just in case, access to your site's files (your host's file manager, FTP or SSH).

Hushfort Security needs WordPress 6.2 or newer and PHP 7.2 or newer.

1. Install the free plugin

Upload the ZIP (for now). Hushfort Security is not listed on wordpress.org yet. Until it is, install it from the ZIP file:

  1. In wp-admin, go to Plugins → Add New → Upload Plugin.
  2. Choose the hushfort-security.zip file and click Install Now.
  3. Click Activate.

You can also upload the unzipped folder to /wp-content/plugins/hushfort-security and activate it from the Plugins screen.

Once it is on wordpress.org, you'll be able to search for "Hushfort" under Plugins → Add New and install it from there, with updates through WordPress as usual.

Nothing changes on your site when you activate. Hide Login does nothing until you choose a path.

2. Open the Hushfort dashboard

A new Hushfort menu appears in wp-admin. Its dashboard shows one status card per layer, so you can see at a glance which doors are open and which are closed. Each card links to the settings for that layer.

Start with Surface Scan. It sends real requests to your own site and shows what it exposes: the login page, XML-RPC, published usernames.

3. Hide the login page

  1. Open Hide Login.
  2. Choose a login path, for example my-door-7. Use letters, numbers and hyphens. Avoid obvious words like login or admin.
  3. Save.

From now on, wp-login.php and wp-admin return a "not found" page to visitors who are not logged in. Your login form lives at yoursite.com/my-door-7. admin-ajax, the REST API, WP-Cron and XML-RPC keep working.

4. Save your new login URL

Before you log out, do two things:

  • Save the URL in your password manager or somewhere private.
  • Test it in a private browser window. If the login form opens there, you're done.

Hiding the login page cuts down automated noise, but it is not enough on its own. Pair it with login limits, two-factor login, strong passwords and updates.

5. Know the "If you lose access" card

The dashboard has an If you lose access card. It shows your current login URL and the emergency lines you can add to wp-config.php if you ever forget it. The short version:

define( 'GATEKEEPER_LOGIN_SLUG', 'new-path' );

Add that line above /* That's all, stop editing! */ and the login form opens at yoursite.com/new-path. The full list of ways back in is on the Locked out? page.

Next steps