Hide Login Area with "example.com" shows login page?

Using iThemes Security 4.0.5 with Hide Login Area enabled, our login is exposed when we access “example.com”, but the site works at “www.example.com”. We do have the “www.example.com” configured as our site’s address in WordPress, so all I can figure is the plugin has screwed something up.

https://wordpress.org/plugins/better-wp-security/