Custom login URL generator

<?php
// Custom login URL: /secure-login instead of /wp-login.php
add_action( 'init', function () {
	add_rewrite_rule( '^secure-login/?$', 'wp-login.php', 'top' );
} );

// Rewrite the login form's own links (wp_login_url, wp_logout_url, etc.) to the new slug
add_filter( 'site_url', function ( $url, $path, $scheme, $blog_id ) {
	if ( strpos( (string) $path, 'wp-login.php' ) === false ) {
		return $url;
	}
	return str_replace( 'wp-login.php', 'secure-login', $url );
}, 10, 4 );

// Block direct access to wp-login.php and wp-admin for logged-out visitors
add_action( 'init', function () {
	global $pagenow;
	$is_login_request = 'wp-login.php' === $pagenow
		&& ! isset( $_GET['loggedout'] )
		&& strpos( $_SERVER['REQUEST_URI'] ?? '', 'secure-login' ) === false;
	$is_admin_request  = is_admin() && ! wp_doing_ajax() && ! is_user_logged_in();
	if ( $is_login_request || $is_admin_request ) {
		wp_die( 'Not found', 'Not found', array( 'response' => 404 ) );
	}
} );

// After activating: go to Settings > Permalinks and click "Save Changes" once,
// otherwise /secure-login returns a 404 (the rewrite rule needs flushing).