I'm on a security kick right now and my current project is a server with a Wordpress site (that used to be a Joomla site). I sometimes get 50 requests a day to

/wp-login.php (the Wordpress default login page)

or

/administrator (the Joomla default login page)

I obfuscate my login pages so they 404. But I don't like to have people try to hack my website.

I'm thinking about 301 redirecting those requests to the home page hopefully to confuse the brute-force bots. Would there be any drawbacks to such an approach?

I'm also thinking about sending other hack requests there, like author pages, search pages and non-existent plugins.

I'm on a security kick right now and my current project is a server with a Wordpress site (that used to be a Joomla site). I sometimes get 50 requests a day to

/wp-login.php (the Wordpress default login page)

or

/administrator (the Joomla default login page)

I obfuscate my login page so they 404 but they continue to give 200 OK instead of 404 Not Found. 

I don't like to have people try to hack my website.

I'm thinking about 301 redirecting those requests to the home page hopefully to confuse the brute-force bots. Would there be any drawbacks to such an approach?

I'm also thinking about sending other hack requests there, like author pages, search pages and non-existent plugins.