Protect your /wp-admin and wp-login.php pages from being accessed without editing .htaccess