Do fake wp-login pages help prevent webapp attacks?

Using non-standard paths for your WordPress login and admin pages would stop automated brute-force attacks scanning for every example.com/wp-login.php, but the practice you describe is just messing around with the attackers and doesn't really do any good nor harm.

Best way to stop the bots is to use strong passwords and Fail2Ban.

A fake wp-login & wp-admin could be used as a honeypot for learning more about the ongoing attacks, though. I like to collect the attempted login credentials to know which leaks are currently popular. I also let the credentials "work" randomly to collect the malware they are trying to install. Of course it doesn't work, because it just looks and acts like WordPress without being one. However, by reverse engineering the malware I'm able to learn how it's trying to hide, which gives me an advantage when cleaning infected sites for customers.


It is not an effective way to stop bots. Bots will register that link as providing a response. They will not "give up" because the end result is not what they expected.

It would be more effective to have have a fake login page and block any IP that attempts to log in.


By adding fake login pages you would actually be turning your website into a honeypot, which would attract more bots and actually increase your server load. I don't know why StackExchange redirects to YouTube, maybe it's just for fun (it looks like they redirect you to random 10-hour videos, including a 10-hour trololol song). If you want to avoid attracting any attention, you should return HTTP 404 and at the same time maybe also ban the IP. Note that, as Esa Jokinen pointed out in his comment, you should be careful when you decide to ban IPs, to avoid possible issues that would lead to a denial of service.