Comment by netsectoday

You should drop down a few layers on the OSI model and catch this at your reverse proxy instead of publishing login pages to catch every permutation of 'wp' in urls.