How to change the WordPress login URL, and what it does and does not protect

WordPress has no setting for its login address. The login page is a file, wp-login.php, and a plugin is what moves it: you choose a new address such as https://example.com/staff-door/, and the plugin refuses visitors who ask for /wp-login.php or /wp-admin/ without being logged in.

Doing this cuts down the automated requests aimed at the address every WordPress site shares. It does not make a password harder to guess, and it leaves xmlrpc.php, the other place that takes a password, where it was. Treat it as a way to quiet the logs. A strong password and two-factor login are what protect the account.

What moving the login page does, and what it does not

WordPress's own guidance on brute force attacks gives the idea one line: obscuring the login address can reduce noise and should not be the only defense. Its hardening guide calls security through obscurity "generally an unsound primary strategy."

The makers of one of the plugins below say the same about their own feature. The documentation for Kadence Security's version says it is not a bad practice, and adds: "By all means use it, just don't trust it alone."

What it does:

• Password-guessing programs that only try /wp-login.php get no login form.
• Fewer password attempts are made, so a log of failed logins has less in it. The plugin runs inside WordPress, so each request it refuses still costs the server some work.

What it does not do:

• It does not protect a weak password. Anyone who learns the new address is at the same login form as before.
• It does not move xmlrpc.php. WordPress's guidance names that file as a frequent target for password guessing. Kadence's documentation makes the same point: there are ways to log in without a browser, such as XML-RPC and the REST API.
• It does not stay secret by itself. The address is known to everyone who logs in, and it sits in browser histories and in any email that links to it.

How to protect WordPress from brute force attacks puts the measures in order of worth and covers xmlrpc.php. How to set up two-factor authentication in WordPress has the steps for the second login step. Do those first. Move the login page afterwards, if the noise still bothers you.

When to leave the login page where it is

• Anyone can register on the site. The listing of WPS Hide Login says the old addresses for registering and for a lost password are not forwarded to the new ones, because forwarding would give the new address away. You have to hand out the new address yourself. An address given to every member is no longer hidden.
• Customers or members log in. A change to the login page can touch how they log in, log out and reset a password. See "What can break" below before you decide.
• Several people look after the site. Each of them needs the new address, and so does anyone who helps in an emergency.

The ways it is done

WordPress builds the login address in one function, wp_login_url(), from the file name wp-login.php. There is no field for it on any settings screen. WordPress does let a plugin change what that function returns, and that is why a plugin is the tool for the job.

A plugin has to close /wp-admin/ to logged-out visitors as well. WordPress sends a visitor who is not logged in from /wp-admin/ to the login page, which would show the new address to anyone who asked.

A plugin built for it: WPS Hide Login

WPS Hide Login does this one thing. Its listing on WordPress.org says:

• It does not rename or change WordPress's own files, and it adds no rewrite rules. It intercepts page requests.
• Once it is on, the wp-admin directory and the wp-login.php page cannot be reached, so you should bookmark or remember the new address.
• Deactivating it brings the site back to the state it was in before.
• The registration form, the lost password form, login widgets and expired sessions keep working. It names BuddyPress, bbPress, Jetpack, WPS Limit Login and User Switching as compatible.
• It does not work with plugins or themes that have wp-login.php written into their own code.
• It works on multisite, with subdomains and with subfolders.
• It is maintained, and free support is not guaranteed.

A security plugin that includes it

If a security plugin is already installed, look there before adding another plugin. Two of the plugins in WordPress security plugins compared have the feature.

Kadence Security lists it as Hide Login URL. Its documentation, which still uses the plugin's earlier name Solid Security, calls it Hide Backend and puts it at Security > Settings > Advanced > Hide Backend. There you set a Login Slug. The slug cannot be login, admin, dashboard or wp-login.php, and should use only letters, numbers, hyphens and underscores. A logged-out visitor to the old addresses gets a 403 error, or is sent to a page you choose. The plugin's authors ask you to take a complete backup of the site before using any of its features.

All-In-One Security (AIOS) has a Rename Login Page tab under AIOS > Brute Force. Its makers describe checking "Enable Rename Login Page Feature" and entering the new address. Since version 5.5.0 the feature also takes an address to send logged-out visitors to when they ask for wp-admin.

Run one plugin for this, not two. Two plugins that both intercept the login page get in each other's way.

Do not rename or edit wp-login.php

Renaming the file, or editing it to answer at another name, does not last. WordPress's documentation on updating warns that an update affects all the core files and that any changes made to them are lost. wp-login.php is one of the files an update replaces. The file would come back under its own name, and your edits would be gone.

Change the address with WPS Hide Login

To undo the change, deactivate the plugin on the Plugins screen. The login page is at /wp-login.php again.

With a security plugin's version of the feature, the outline is the same. With Kadence Security the private window matters more. Its documentation says that opening the new address sets a cookie for one hour, and that for that hour the same browser can open /wp-login.php and /wp-admin/ directly. Only a private window shows what a stranger sees.

What can break

• Links to the old address. A bookmark, a link in a menu or footer, or a line in a welcome email that points at /wp-login.php stops working. Change each one, or remove it.
• Password reset emails. WordPress builds the link in a reset email on wp-login.php, so the plugin has to rewrite it. WPS Hide Login's listing says the lost password form keeps working. AIOS's changelog records a fix for password resets that failed with its renamed login page. Try it yourself: in a private window, ask for a reset for your own account and follow the link in the email. If no email arrives at all, that is a separate fault, covered in what to do when WordPress is not sending email.
• Plugins and themes that name the file. Code that asks WordPress for the login address can be given the new one. Code with wp-login.php written into it cannot. A "log in" link, a members' menu or a form that sends people to the old address is the sign.
• A cached login page. A cache must not store the login page, or the plugin's refusals, and serve them to other visitors. AIOS's makers describe adding no-cache headers to its refusals for this reason. If logging in starts to loop, see how to fix a WordPress login page that keeps refreshing or redirecting.
• Stores. WooCommerce shows logged-out customers a login form on its My account page, and its lost password and logout addresses hang off that page, so a customer can log in, log out and reset a password without going to wp-login.php. That does not make a store safe to change without checking. AIOS's changelog lists fixes for WooCommerce logouts with the login page renamed, and Kadence's documentation says the WooCommerce mobile app may fail to log in while Hide Backend is on.

On a site where customers or members log in, try the change on a staging copy of the site first, and go through logging in, logging out and a password reset as a customer would.

How to get back in when the address is lost

Your account and your content are untouched. Only the way to the form is missing. Work down this list.

For AIOS, the folder is all-in-one-wp-security-and-firewall, and for Kadence Security it is better-wp-security. Switching a security plugin off switches off everything else it does too, so turn it back on as soon as you are in. On multisite, add --network to the WP-CLI command to deactivate a plugin for the whole network.

If /wp-login.php still refuses you with the plugin off, something else is in the way. WPS Hide Login's listing points to rules that other plugins have added to .htaccess. How to fix the 403 Forbidden error shows how to find the rule and how to put WordPress's standard file back.

If you cannot reach the site's files or its database, being locked out of your own site is one issue on one site, which is what our one-time fix covers.

What not to rely on

• The new address as a secret. It protects nothing once someone knows it. AIOS's changelog records repairs to more than one way a hidden login page could be found, among them a redirect from the non-www version of a site's address.
• A moved login page in place of two-factor login. A correct password at the new address is a valid login. The second step is what stops a guessed or stolen password.
• A moved login page to close XML-RPC. If nothing on the site uses xmlrpc.php, close it. The brute force guide has the server rules.
• Memory. Keep the address in the password manager, beside the password it goes with.

WordPress security: what to do, in order of what matters most puts all of this beside updates, backups and the rest.