iThemes Security (Now Kadence Security) Setup: Brute Force, Login URL

This article is a localized edition of the Japanese original. Read the Japanese original

iThemes Security is a WordPress security plugin that was later renamed Solid Security, and as of October 2026 it is published on WordPress.org as "Kadence Security." Despite the name changes, the plugin slug is still better-wp-security, so existing sites switch to the new name through regular updates.

This article covers brute force protection, changing the login URL (Hide Backend), file change detection and additional hardening, explaining what each setting means and its default. Setting names and defaults were checked against the plugin's settings definitions (version 10.0.x as of October 2026).

Installation and initial setup

In the WordPress admin, go to "Plugins" → "Add New Plugin", search for "Kadence Security" and install it, or install it with WP-CLI.

wp plugin install better-wp-security --activate

After activation, a "Security" menu is added to the admin, and the Setup screen opens first. Once you answer questions such as your site type and finish the initial setup, the "Security" menu lists Dashboard, Site Scans, Firewall, Vulnerabilities, User Security, Settings, Tools and Logs. You enable and adjust individual features under "Security" → "Settings."

Set up brute force lockouts

The feature that temporarily locks out IP addresses or users after failed logins is "Local Brute Force." It is enabled by default.

Lockout duration and the handling of repeat attackers are set in the Lockouts section of "Global Settings," which applies to all features.

There is also "Network Brute Force," which blocks IPs flagged as attackers on other sites. Enabling it means communicating with the plugin vendor's network, so review the terms before you turn it on.

Check current lockouts in the database

Lockouts are recorded in the wp_itsec_lockouts table (wp_ is your site's table prefix). If you can't get into the admin, you can list active lockouts with WP-CLI.

# Show the 10 most recent active lockouts
wp db query "SELECT lockout_id, lockout_type, lockout_host, lockout_username, lockout_start, lockout_expire FROM $(wp db prefix)itsec_lockouts WHERE lockout_active = 1 AND lockout_expire_gmt > UTC_TIMESTAMP() ORDER BY lockout_start DESC LIMIT 10"

If your own IP is locked out, the safest option is to wait until the Minutes to Lockout period passes. If you're in a hurry, you can release it the same way the plugin does when you release a lockout in the admin: set lockout_active to 0 on that row (replace 123 with the lockout_id from the command above).

wp db query "UPDATE $(wp db prefix)itsec_lockouts SET lockout_active = 0 WHERE lockout_id = 123"

If you can get into the admin, it's more reliable to review and release lockouts and banned IPs under "Security" → "Firewall."

Change the login URL (Hide Backend)

Hide Backend shows the login screen at a different URL instead of wp-login.php. You'll find it in the advanced settings (Advanced) under "Security" → "Settings."

For example, if you set Login Slug to a hard-to-guess string, the login screen becomes https://example.com/your-hard-to-guess-string. Before saving the change, record the new URL somewhere safe, such as a password manager.

If you forget the URL, you can retrieve it with WP-CLI, because the plugin stores its settings together in an option named itsec-storage.

# Show the Hide Backend Login Slug
wp option pluck itsec-storage hide-backend slug

If WP-CLI isn't available, temporarily rename the wp-content/plugins/better-wp-security folder via FTP or similar to stop the plugin, and the regular wp-login.php comes back.

As the Hide Backend description itself notes, the new URL can leak through things like privacy request confirmation emails or a theme's login form. It does reduce bot traffic, but don't rely on it alone; combine it with two-factor authentication.

Set up file change detection

"File Change" alerts you when your site's files change unexpectedly. It is off by default, so enable it under "Security" → "Settings."

"Ignore File Types" is a list of extensions that are not checked. Most attacks modify text files such as PHP and JavaScript, so don't put .php or .js in this list. Adding places whose files change every day, such as a caching plugin's storage folder, to Excluded Files and Folders reduces false alarms.

Review and change who gets notified of changes, and how often emails are sent, in the plugin's notification settings (Notification Center).

Additional hardening (System Tweaks and WordPress Tweaks)

The advanced settings (Advanced) include options that tighten server configuration and WordPress behavior.

System Tweaks

These work by writing rules to the server configuration file (.htaccess on Apache). Some plugins and themes call PHP files in their own folders directly, so after enabling Disable PHP in Plugins / Themes, check that your site displays correctly and that things like contact forms still work. You can review the written rules under "Security" → "Tools."

WordPress Tweaks

XML-RPC is used by Jetpack, mobile apps and external blogging tools to publish posts. If you don't use any of these, choose Disable XML-RPC; if you only want to stop pingbacks, choose Disable Pingbacks.

Cautions

• Back up your site files and database before changing settings. Features that write rules to .htaccess in particular can make the site stop loading on some server setups.
• Running it alongside another security plugin with a firewall or login limits, such as Wordfence, can make the same work run twice and make lockouts harder to trace. Keep only one plugin for overlapping features.
• In case Hide Backend or a lockout shuts you out, make sure you have a way into the server through WP-CLI or FTP.

Summary

• iThemes Security became Solid Security and, as of October 2026, Kadence Security. The slug is still better-wp-security
• Tune brute force protection with Local Brute Force (defaults: 5 per IP, 10 per user) and the lockout duration and permanent bans in Global Settings. Put administrators' static IPs in Authorized IPs
• Find the Hide Backend URL with wp option pluck itsec-storage hide-backend slug, and use it together with two-factor authentication
• File Change's Ignore File Types is a "do not check" list. Don't put .php or .js in it

Related articles:

• How to set up Solid Security
• How to add two-factor authentication to WordPress
• Initial Wordfence setup

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)