I'm on a security kick right now and my current project is a server with a Wordpress site (that used to be a Joomla site). I sometimes get 50 requests a day to
/wp-login.php (the Wordpress default login page)
/administrator (the Joomla default login page)
I obfuscate my login page
so they 404 but they continue to give 200 OK instead of 404 Not Found.
I don't like to have people try to hack my website.
I'm thinking about 301 redirecting those requests to the home page hopefully to confuse the brute-force bots. Would there be any drawbacks to such an approach?
I'm also thinking about sending other hack requests there, like author pages, search pages and non-existent plugins.