melvin.adapty

added as follows and it worked

inside

sub vcl_miss {

 if (!(req.url ~ "wp-(login|admin)" || req.url ~ "(secret-login)")) {
    unset req.http.cookie;
}
}

and

sub vcl_backend_response {
if (!(bereq.url ~ "wp-(login|admin)" || bereq.url ~ "(secret-login)")) {
    unset beresp.http.set-cookie;
}
}

Worked !!
Thanks Chris Jeanfor pointing me out the issue ??

will some thing like this do to my dafault.vcl

if ( !( req.url ~ ^/secret-login/) ) {
  unset req.http.Cookie;
}

what exactly i have to do . i am not good in server configs and i am the server guy

I am able to login when I try after disabling the plugin .But cannot login with hide admin url setting on .It shows the cookie error

# BEGIN iThemes Security - Do not modify or remove this line
# iThemes Security Config Details: 2
	# Enable the hide backend feature - Security > Settings > Hide Login Area > Hide Backend
	RewriteRule ^(/)?secret-login/?$ /wp-login.php [QSA,L]

	# Disable XML-RPC - Security > Settings > WordPress Tweaks > XML-RPC
	<files xmlrpc.php>
		<IfModule mod_authz_core.c>
			Require all denied
		</IfModule>
		<IfModule !mod_authz_core.c>
			Order allow,deny
			Deny from all
		</IfModule>
	</files>

	<IfModule mod_rewrite.c>
		RewriteEngine On

		# Reduce Comment Spam - Security > Settings > System Tweaks > Comment Spam
		RewriteCond %{REQUEST_METHOD} POST
		RewriteCond %{REQUEST_URI} /wp-comments-post\.php$
		RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
		RewriteCond %{HTTP_REFERER} !^https?://(([^/]+\.)?232\.192|jetpack\.wordpress\.com/jetpack-comment)(/|$) [NC]
		RewriteRule ^.* - [F]
	</IfModule>
# END iThemes Security - Do not modify or remove this line

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

This is my .htacces file content