My Windows 2003 VPS recently hang due to bots hammering my WordPress login php non-stop for hours (determined from IIS6 logs).  This caused MySQL to use up all the allocated 1G RAM.  After resetting my VM, I quickly renamed wp-login.php to prevent my server from crashing again.

As per standard practice to rename the administrator username and admin login folders/paths of newly installed web applications, right after I installed my WP in June for the first time, I had tried to rename wp-admin folder, but failed.  I added Windows authentication to wp-admin in hope that this will help improve security, however, as it has been proved, this didn't prevent a DDOS like attack on wp-login.php.

For the time being, I'll have to rename it back to the original wp-login.php should I need to login.  Is there a way to permanently rename wp-login.php and have it function at the same time?  I've installed the [Ionics Isapi Rewrite Filter][1] to allow IIS6 to support htaccess to some extent.

So far, the articles I found on the Internet are for Apache and for changing the admin username and password (one website even suggested using a password that is at least 30 characters long!).

[1]: http://iirf.codeplex.com/

**EDIT:**

I removed anonymous access for wp-login.php also, enabled Windows authentication and then diverted the Custom Error page for "HTTP 401.2 - Unauthorized" error to a blank HTM file.  I don't know if this method can fool the botnet but when tested with curl.exe, if the user is unauthenticated, a blank page will appear.

**EDIT:**

The above method proves to be ineffective.  :(  The botnet came back and attacked my protected wp-login.php.  I've renamed wp-login.php, let's see what happens now.