Protect the wp-login directory, explicitly allow the admin-ajax.php script, and rewrite /login to wp-login.php .