DENKEEPER · WORDPRESS LOGIN PROTECTION
DenKeeper moves your login to a secret address — then guards it with a password gate styled to your brand. Strangers find a genuine 404. Members find a door that looks like it belongs to your site.
No 2FA fatigue · Your brand, not ours · About five-minute setup
Solo licence · 1 site · one year of updates and support · 14-day refund
Automated scanners hit wp-login.php and xmlrpc.php on WordPress sites every day, trying passwords and looking for a way in.
A redirect from the usual login address can reveal where the hidden login moved. DenKeeper is designed to return a genuine 404 to logged-out visitors instead.
A login page that matches your club or business feels more welcoming than a generic security screen bolted onto your site.
Choose your own secret login address, or let DenKeeper generate one. Logged-out visitors who try wp-login.php or wp-admin see your site’s normal 404 page: no redirect, no change to the address bar and no clue that a login is there.
Logout and lost-password links keep working; DenKeeper updates them to use the secret address automatically.
Before visitors see the WordPress login form, they meet your gate: your logo, colours, wording and password. Issue different named passwords to groups such as Users, Admin or Committee, then see which password opened the door in the activity log.
One lightweight plugin for the gate, the audit trail and the tools behind the door.
Logged-out visitors see a 404 at the usual login routes. The hidden address is not exposed through a redirect.
Set the heading, subtext, button wording, colours, background, footer line and logo from your Media Library.
Create one password per person or group. Enable, disable, reset or delete it, and set reminder dates for scheduled rotation.
Six incorrect guesses freeze that IP for 15 minutes. The correct password continues to work for you, even during an attack.
Check flag, city, ISP / AS number, timezone, per-IP history and bot User-Agent hints. Location lookups are admin-initiated.
Block an individual IP or a whole range. Blocked addresses cannot pass the gate with any password.
Remember-me devices are cryptographically signed and associated with a password. Reset that password and its remembered devices are invalidated.
Review a door-tagged activity log for gate and WordPress logins, lockouts, whitelisted IPs, alerts, gate styling and the secret address.
Optional controls can disable XML-RPC and Application Passwords and stop public REST API username discovery. The gate includes its own hardening headers.
The gate can email a one-time reset link to the address assigned to that password or to the admin inbox. The link expires after 60 minutes and works once. The site owner is notified when it is used, with the IP and location details.
A quick setup for you. A familiar door for your members.
Pick your own login URL or generate one. Logged-out visitors at the usual login routes get a 404, not a redirect.
Add your logo, colours and wording. Create named passwords for the people or groups who need access.
Members open the secret address, enter their group password and can choose Remember me. No authenticator app or code is required.
Add your approved product screenshots in these four image spaces.
Give each group a named password. Members get a branded gate without needing to set up an authenticator app.
Keep your members moving through a familiar login while routine scanners meet the hidden address and gate.
Give each client a branded login and use named passwords to make the audit trail easier to understand.
Replace a flood of login-attempt emails with a quieter dashboard, an activity trail and one-click blocking.
Compare DenKeeper with a typical “free hider + security suite + custom CSS” stack.
Solo — 1 site — $59 per year
Every feature included, plus one year of updates and support and a 14-day no-questions refund. Lifetime licence options are also available.
Need more than one site? Ask about agency or lifetime options.
The gate runs on login requests. Public pages do not load the gate.
They open the secret login link, enter the group password and can tick Remember me. No authenticator app or one-time code is required.
They meet the password gate and lockout controls. You can change the secret address; the old one stops working.
Yes. The log shows gate and WordPress login attempts, IP, time, bot hints and the text entered on incorrect gate guesses. You can open IP details and block suspicious addresses.
It handles login hiding, the branded gate and login lockouts. It does not scan files or filter all site traffic; a firewall or malware scanner can coexist with it.
An optional setting disables xmlrpc.php, a route frequently targeted by automated login attempts.
Yes, once your host is forwarding the real visitor IP. If needed, ask your host to enable that setting.
The supplied Install Guide explains how to rename the plugin folder through your host’s file manager or FTP to restore the normal login route.
DenKeeper gives members a branded way in and gives strangers a 404 instead.
Questions? pete@quicklinkdesigns.com