Why call this feature ‘Hide Backend’ when it clearly no longer does. The example url example.com/wp-login.php?itsec-hb-token=wplogin is correct as this is new new way the feature works but it does not hide the backend. By typing ‘wp-admin’ you are taken to the login in screen and the url displays example.com/wp-login.php?itsec-hb-token=wplogin6&redirect_to=http%3A%2F%2Fwww.example.com%2Fwp-admin%2F&reauth=1 so, as you can see the backend is not hidden.
I think ithemes should either fix this issue or remove this feature as it is very misleading and no longer does what they say i does.