Hi Gerroald,
Okay, after seeing this same issue, I think I figured it out (at least for our site). If you have w3 Total Cache installed along with iThemes Security, and you enable the ‘hide backend’ feature in iThemes, you will get this problem.
To fix it, go into W3TC’s page cache settings. By default, W3TC does not cache any .php pages in any folder starting with “wp-“. However, since the backend has been rewritten, you need to tell W3TC not to cache the new login address. In the ‘Advanced’ section of the Page Cache settings, there is a ‘Never cache the following pages’ option. Add something like the following in this section (where ‘mysecretaddress’ is the login page you set in iThemes):
/mysecretaddress
Hope this helps!
Matt