Protect WordPress admin panel with nginx

nginx.conf

limit_req_zone $binary_remote_addr zone=login:10m rate=3r/m;
set $secret_admin "948b5fee-a224-4c7d-bbf4-d4231e85be2c";

location ~* ^/hidden-wp-admin/?$ {
    add_header Set-Cookie "secret_admin=$secret_admin; Path=/";

    return 302 /wp-admin/;
}

location = /wp-login.php {
    set $login_pass 0;

    if ($arg_action = 'logout') {
        set $login_pass 1;
    }

    if ($cookie_secret_admin = $secret_admin) {
        set $login_pass 1;
    }

    if ($login_pass = 0) {
        return 302 /;
    }

    limit_req zone=login burst=3 nodelay;

    include fastcgi_params;
    fastcgi_pass unix:/var/run/php/php8.1-fpm.sock;
    fastcgi_param SCRIPT_FILENAME $document_root/wp-login.php;
}