The plugin catches the new address itself, before WordPress decides what the request is, so permalinks and rewrite rules are not involved and re-saving them changes nothing. Three things actually cause it:
- the word you chose was refused. A word under three characters, one WordPress owns (
login,admin,wp-admin,feedand a few more), or one that is already a page on your site is not accepted, and the door stays where it was. The screen says so when it happens; - a page cache is holding the 404 it stored from before the move. Clear it;
- a server rule is answering first. Some hosts have a rule for
/wp-login.phpor for unknown paths that never reaches WordPress.
wp login-security door prints the address the plugin thinks the door is at, and the recovery link still opens the original wp-login.php from anywhere.
Still stuck? Ask the developers who wrote it. We aim to reply within one business day.
Login Security
Stop the machines guessing at your passwords, and see exactly who has been trying.
From $19 a year · every feature · 30-day refund
