I am running a simple up-to-date WP site.
To change the WP Login URL I use AIO WP Security & Firewall plugin, it also inform me about wrong login attempts.

I thought to make it harder to enter I add to the nginx config following entry:

   location /newlogin {
    deny  all;

http://www.example.org/newlogin is my WP Login defined in that AIO plugin.
I can only access the WP site from that IP I allowed.
BUT still I receive those login attmept email...
How is that possible? How can somebody try the Login without executing that URL?

1 Answer 1


They can use the following address: http://www.example.org/wp-admin

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.