limited direct access to wpadmin and wplogin. set redirects.