I've recently installed a couple of apps (WordPress and BlogPad Pro) and I'm a bit surprised to see that they can indeed post to my blogs, even though I haven't given them the renamed login and wp-admin pages that I set up through iThemes Security.
My understanding was that posting could only happen "through" the back end of the blog; i.e. if you couldn't log into the blog through the login page, you couldn't post to the blog either. But evidently, with my username and password, these apps can post to the blog.
How does the app know to get "around" the obscured login page to post to the blog?