Title: HSArticle Login Warden Author: hsarticle Published: 2026 年 7 月 18 日 Last modified: 2026 年 7 月 18 日 --- 搜尋外掛 ![](https://ps.w.org/hsarticle-login-warden/assets/banner-772x250.png?rev=3612971) ![](https://ps.w.org/hsarticle-login-warden/assets/icon-256x256.png?rev=3612971) # HSArticle Login Warden 由 [hsarticle](https://profiles.wordpress.org/hsarticle/) 開發 [下載](https://downloads.wordpress.org/plugin/hsarticle-login-warden.1.0.0.zip) * [詳細資料](https://tw.wordpress.org/plugins/hsarticle-login-warden/#description) * [使用者評論](https://tw.wordpress.org/plugins/hsarticle-login-warden/#reviews) * [安裝方式](https://tw.wordpress.org/plugins/hsarticle-login-warden/#installation) * [開發資訊](https://tw.wordpress.org/plugins/hsarticle-login-warden/#developers) [技術支援](https://wordpress.org/support/plugin/hsarticle-login-warden/) ## 外掛說明 Most “hide login” plugins only do one thing: change the URL of wp-login.php. HSArticle Login Warden does that too, but it’s built around a wider goal — make it harder for anyone to find or confirm who has access to your WordPress admin in the first place. Hiding the login form doesn’t help much if your usernames are still leaking out through three other doors, so HSArticle Login Warden closes those too, all as optional one-click toggles. It doesn’t rename or modify any core files, and it doesn’t add rewrite rules — it simply intercepts requests for wp-login.php and /wp-admin and shows a 404 (or redirects) to logged-out visitors, while your chosen custom URL loads the real login form. **Custom login URL** * Set any custom login URL slug * Choose what logged-out visitors see when they hit the old login page or /wp-admin: a 404 page, a redirect to your homepage, or a redirect to any custom URL * Your current login URL is always visible on the settings page with a one-click Copy button, so you never lose track of it * Built-in conflict check — you can’t accidentally set your login slug to something that collides with an existing page or post **Optional hardening toggles** * Disable XML-RPC (xmlrpc.php) — a second, often-forgotten login door and a common brute-force target * Generic login error messages — stops WordPress confirming whether a failed login had a real username or not * Block username enumeration via ?author=1, ?author=2, etc. — stops one of the most common ways real usernames get discovered * Hide the /wp-json/wp/v2/users REST endpoint from logged-out requests — this lists every username on your site by default None of these toggles track, log, or store anything about your visitors — they simply stop information from leaking out. All logged-in functionality (dashboard, admin, post editing) works completely normally; every toggle here only affects logged-out visitors. Deactivating the plugin brings your site back to its default state immediately. ## 安裝方式 1. Go to Plugins > Add New. 2. Search for “HSArticle Login Warden”. 3. Install and activate. 4. You’ll be redirected to Settings > HSArticle Login Warden — set your new login URL there and save. 5. Bookmark your new login URL before you log out! ## 常見問題集 ### I forgot my login URL! Check the `hsarlowa_settings` row in your site’s `wp_options` database table, or deactivate the plugin (via FTP/file manager if needed) to restore the default wp- login.php URL. ### Does this work with caching plugins? Yes, but if you use a page-caching plugin, exclude your new login URL from the cache the same way you would for any dynamic page. ### Will disabling XML-RPC break anything? It will stop the classic WordPress mobile apps, the old XML-RPC based publishing tools, and some Jetpack features that rely on it from working. Most modern sites using the REST API instead are unaffected. Leave it unchecked if you’re unsure. ### Will blocking ?author= links break my author archive pages? No. Only the numeric query-string form (?author=1) is blocked for logged-out visitors. Normal pretty-permalink author pages (/author/yourname/) keep working exactly as before. ### Will hiding the REST users endpoint break the block editor? No. /wp/v2/users/me (used by the block editor for the currently logged-in user) is untouched. Only the endpoints that list every username to logged-out requests are hidden. ### Will this break my site if I forget to bookmark the new URL? No. Deactivating the plugin (via FTP/file manager if needed, by renaming the plugin folder) immediately restores the default wp-login.php URL. ## 使用者評論 這個外掛目前沒有任何使用者評論。 ## 參與者及開發者 以下人員參與了開源軟體〈HSArticle Login Warden〉的開發相關工作。 參與者 * [ hsarticle ](https://profiles.wordpress.org/hsarticle/) [將〈HSArticle Login Warden〉外掛本地化為台灣繁體中文版](https://translate.wordpress.org/projects/wp-plugins/hsarticle-login-warden) ### 對開發相關資訊感興趣？ 任何人均可[瀏覽程式碼](https://plugins.trac.wordpress.org/browser/hsarticle-login-warden/)、 查看 [SVN 存放庫](https://plugins.svn.wordpress.org/hsarticle-login-warden/)，或 透過 [RSS](https://plugins.trac.wordpress.org/log/hsarticle-login-warden/?limit=100&mode=stop_on_copy&format=rss) 訂閱[開發記錄](https://plugins.trac.wordpress.org/log/hsarticle-login-warden/)。 ## 變更記錄 #### 1.0.0 * Initial release. ## 中繼資料 * 版本 **1.0.0** * 最後更新 **5 天前** * 啟用安裝數 **少於 10 次** * WordPress 版本需求 ** 5.6 或更新版本 ** * 已測試相容的 WordPress 版本 **7.0.2** * PHP 版本需求 ** 7.4 或更新版本 ** * 語言 * [English (US)](https://wordpress.org/plugins/hsarticle-login-warden/) * 標籤: * [custom login url](https://tw.wordpress.org/plugins/tags/custom-login-url/)[hide login](https://tw.wordpress.org/plugins/tags/hide-login/) [login security](https://tw.wordpress.org/plugins/tags/login-security/)[wp login](https://tw.wordpress.org/plugins/tags/wp-login/) [xmlrpc](https://tw.wordpress.org/plugins/tags/xmlrpc/) * [進階檢視](https://tw.wordpress.org/plugins/hsarticle-login-warden/advanced/) ## 評分 這個項目尚無任何評論記錄。 [Your review](https://wordpress.org/support/plugin/hsarticle-login-warden/reviews/#new-post) [查看全部使用者評論](https://wordpress.org/support/plugin/hsarticle-login-warden/reviews/) ## 參與者 * [ hsarticle ](https://profiles.wordpress.org/hsarticle/) ## 技術支援 使用者可在技術支援論壇提出意見反應或使用問題。 [檢視技術支援論壇](https://wordpress.org/support/plugin/hsarticle-login-warden/)