Administrator secret URL parameter If you enter "foobar" (without the quotes) in here, then you must access your site's backend as http://www.example.com/wp-admin/?foobar i.e. append a questionmark and the secret word. If you skip the ?foobar part, you can't even see the login page. If you do not want to enable this feature please delete its contents and leave this field blank.

Important notes: This field will contain either your existing Administrator secret URL parameter (if you have already configured one) or a new, random one if there is no Administrator secret URL parameter already set up on your site. Do keep in mind that if you have disabled the Administrator secret URL parameter and you run the Quick Setup Wizard again a NEW, COMPLETELY RANDOM value will be shown in this field.

Password-protect WP administration This is designed to add an extra level of protection to your site's administrator (wp-admin) back-end, asking for a username and password before accessing the administrator login page or any other file inside the wp-admin directory of your site. It does so by using Apache .htaccess and .htpasswd files, so it won't work on IIS or NginX hosts.

Enter your email address in Send an email for all administrator login attempts. Admin Tools will be sending you an email whenever anyone tries to log in to your site's wp-admin as an Administrator. The minute you receive an email which wasn't triggered by a trusted person, you know you have to get your site off-line a.s.a.p. Do note that this is a very useful feature! It will send you an email even in the unlikely case that someone, for example, hacks your Wi-Fi, steals your login cookie and then uses your own Wi-Fi connection and login cookie to log in to your site.

Allow administrator access only to IPs in Whitelist will prevent anyone from accessing wp-admin unless they are coming from an IP address in the whitelist. Please only use this if your ISP assigns you a static IP. If you are on a dynamic IP, like most people, enabling this feature will only keep locking you out of your site all the time. If you are unsure set it to No.

Disable editing users' properties prevents any operation on users which would allow the creation of an Administrator user or the elevation of a user's privileges to Administrator status. You will not be able to edit Administrator users or create new Administrator users until you disable this feature!

Enable Web Application Firewall activates the security features which block malicious access attempts to your site.

Enable IP workarounds is only necessary when your site is behind a proxy server. While Admin Tools tries to detect the recommended setting for your site this cannot always be accurate. If you start getting locked out of your site and you see that all blocked access attempts seem to originate from the same IP address - which is different that the IP address you access your site from - you most definitely need to set this to Yes.

Automatically block repeat offenders blocks IPs raising repeated security exceptions on your site, i.e. we have strong reasons to suspect they are hackers. Please note that you may not want to enable this feature until you are sure everything is working smoothly, so that you don't accidentally block yourself out of your site.

Blacklist incorrigible offenders is an extension of the previous feature. If an IP address gets blocked automatically all the time it means that it's very likely not a user who screwed up but a hacker who tries hard to get into your site. Enabling this option will permanently blacklist their IP address so they don't bother you anymore.

Email this address on security exceptions. Enter your email address here to get email notifications about every blocked malicious access attempt. You should be aware that in case of a massive attack against your site you might get plenty of emails. This feature does not serve any real security purpose, it's basically there to make you and your clients feel good by receiving emails whenever something is blocked.

Optional but highly recommended, go to http://www.projecthoneypot.org/httpbl_configure.php and open yourself a Project Honeypot account. After your registration, visit that URL again and you'll see something called "HTTP:BL key". Copy it and paste it into the Project Honeypot HTTP:BL Key field. Project Honeypot analyses data from a vast number of sites and positively identifies IPs currently used by hackers and spammers. This Admin Tools feature integrates with Project Honeypot, examining your visitors' IP addresses. If they are in the black list (known hacker or spammer) they will be blocked from accessing WordPress.

Create a security tightening .htaccess is for advanced users who are using the Apache web server. This feature adds carefully curated directives to increase the performance and tighten the security of your site at the web server level - long before PHP, let alone WordPress, has the chance to run. This is a great line of defense but it may also cause problems with third party plugins. Please read the documentation to understand how it all works!