wp-login.php is effectively renamed, but wp-login is still accessible

wp-login.php should return a 404 page with this plugin. Is that what you mean by being accessible? Does it give you a 404? Thanks for the feedback!

Hi Janneke, I really mean wp-login without .php extension.
It gives me a 200 with actual login form.
Maybe that’s because my Apache is configured with MultiViews on.

Interesting. I could replace

strpos( $_SERVER['REQUEST_URI'], 'wp-login.php' )

with

strpos( $_SERVER['REQUEST_URI'], 'wp-login' )

Do you think that would solve your problem? Not entirely sure what MultiViews does.

Yes, it does the trick.

With MultiViews on, when you access wp-login (without .php) Apache tries to find a “wp-login” file with any extension (could be wp-login.html, wp-login.jpg, whatever) so it ends up with wp-login.php but request URI is just “wp-login”.

Alright, I’ll change this for you with the next version.

Resolved in version 1.8.

It works. Thanks !