How to Change your WordPress Login Page URL (Security Tip)

To change your WordPress login URL, install a plugin like WPS Hide Login and set a custom slug under Settings > General. Your old /wp-login.php address then returns a 404, and logged-out visits to /wp-admin/ get redirected away, so the bots hammering those URLs get nowhere.

WordPress itself has no setting for this, so a plugin (or the hide-login feature inside a security plugin) is the reliable route. Before you save, bookmark the new URL. And keep in mind that a hidden login page cuts noise but is not a replacement for a strong password and two-factor authentication. More on both below.

Video Tutorial

If you want to quickly see how to change your site’s login URL, check out my video below.

No time for a video? Keep reading below.

Why You Should Change Your WordPress Login Page URL

Every WordPress site exposes its login page at the same addresses: /wp-login.php, plus /wp-admin/ and a few core shortcuts like /login/ that redirect there. WordPress is also the most used CMS on the internet, so brute-force scripts can point at those paths without checking what a site runs.

Moving the login page to a custom URL means those bots hit a 404 instead of your login form. You get less server load, cleaner logs, and far fewer failed logins to sort through. It will not stop someone targeting you who finds the new URL, but it removes the constant background noise of broad, automated attacks.

Ways to Change the WordPress Login URL

Here is how the common options compare. Names, install counts, and features come from each plugin’s WordPress.org page.

Method	Cost	Active installs	What else it does	Watch out for
WPS Hide Login	Free	2M+	Nothing, it only moves the login page	Page caches other than WP Rocket need the slug excluded
Kadence Security	Free, Pro available	700K+	2FA, brute force protection, file change detection	Formerly Solid Security and iThemes Security, so older tutorials use those names
All-In-One Security (AIOS)	Free, Premium available	1M+	Firewall, login lockouts, 2FA	The feature is called Rename Login Page
Admin and Site Enhancements (ASE)	Free, Pro available	200K+	Dozens of admin tweaks in one plugin	Multisite is not officially supported; WooCommerce login compatibility is a Pro feature
Wordfence	Free, Premium available	5M+	Firewall, malware scan, 2FA, login CAPTCHA	Does not change the login URL; it defends the default one
Editing or renaming wp-login.php	Free	n/a	Nothing	Undone by the next core update, and easy to lock yourself out

If you only want the URL moved, WPS Hide Login is the simplest choice. If you already run a security plugin, use its built-in option instead of stacking a second plugin that touches the login page. On my serious sites I use Kadence Security Pro for 2FA and rate limiting, and I cover why in my WordPress login security guide.

How to Change Your WordPress Login Page URL with a Plugin

The easiest and most reliable option is the free WPS Hide Login plugin. According to its plugin page, it does not rename core files or add rewrite rules. It intercepts requests to the login page, and deactivating it puts the site back exactly as it was.

• Search for WPS Hide Login in Plugins>add new, then install and activate it.
• Go to Settings>general and scroll to the WPS Hide Login section at the bottom.
• Enter your new slug in the Login url field. Optionally change Redirection url, which is where logged-out visits to wp-admin and wp-login.php go (the default is 404).
• Bookmark the new URL, then click Save Changes. The plugin shows a notice with your new login link.

The change takes effect the moment you save, and the default URLs stop working right away. If you never set a slug, the plugin falls back to /login/, so pick your own. Something memorable is fine, and tell your other admins before you save.

What actually changes (tested)

On a fresh WordPress 7.1.4 site in WordPress Playground, with WPS Hide Login 1.9.19 active and the slug set to secret-door, this is what each URL returned while logged out:

Request (logged out)	Without the plugin	With WPS Hide Login (slug: secret-door)
/wp-login.php	Login form	404
/wp-admin/	Redirect to wp-login.php	Redirect to /404/ (the default Redirection url)
/login/	Redirect to wp-login.php (core shortcut)	No redirect, normal front-end page
/secret-door/	Not a login page	Login form
/wp-login.php?action=lostpassword	Lost password form	404 (use /secret-door/?action=lostpassword)
/xmlrpc.php	Reachable	Still reachable

Two things stood out. The plugin disables core’s /login/ shortcut so it no longer leads to the form, and the lost password and registration links move to your new slug too (for example /secret-door/?action=register). XML-RPC is untouched, which matters for the next section.

Don’t Stop at the Login URL

Changing your login URL is security through obscurity. It hides the door, but it does not strengthen the lock. If a bot or a person finds the new URL, a weak password still falls. Pair the URL change with the measures that actually protect the login:

• Use a strong, unique password, and avoid the username “admin”. This matters more than anything else on this page.
• Turn on two-factor authentication, so a correct password alone is not enough to get in.
• Limit login attempts. Limit Login Attempts Reloaded (now listed as Limit Login Attempts Security) locks out an IP or username after repeated failures, and it covers xmlrpc.php as well as wp-login.php.
• Disable or block XML-RPC if nothing you use needs it, since bots can try passwords there without ever touching the login page.

Avoid Editing Core Files or .htaccess by Hand

You will find tutorials that rename wp-login.php or edit it directly, and others that add redirect rules to functions.php or .htaccess. Skip these on a live site:

• A core update replaces the files that ship with WordPress, so your renamed or edited wp-login.php gets put back (see the upgrading docs).
• Hand-written redirects often miss the logout, password reset, and registration links, which all point at wp-login.php.
• An IP rule in .htaccess locks you out the moment your home IP changes.

A maintained plugin handles all of those URLs together and reverses cleanly when you deactivate it, which is why it is the safer route.

How to Get Back In If You Forget the Custom Login URL

This is the most common problem with any hide-login setup. You have three ways back in, from least to most drastic.

1. Look up the slug

WPS Hide Login stores the slug in the whl_page option. With SSH and WP-CLI, this prints it:

wp option get whl_page

No SSH? Open phpMyAdmin from your host, browse the wp_options table, and search for whl_page. On a multisite where the plugin is network activated, check the sitemeta table, or run wp site option get whl_page.

2. Deactivate the plugin with WP-CLI

wp plugin deactivate wps-hide-login

In the Playground test, /wp-login.php worked again immediately after this. The whl_page value stays in the database, so reactivating the plugin brings back the same slug.

3. Rename the plugin folder over SFTP

If you only have file access, connect with SFTP or your host’s file manager and rename the plugin folder in wp-content/plugins. From a shell in the WordPress root, that looks like this:

mv wp-content/plugins/wps-hide-login wp-content/plugins/wps-hide-login-off

WordPress can no longer load the plugin, so /wp-login.php comes back (confirmed in the same test). Log in, open the Plugins screen so WordPress marks the plugin as deactivated, then rename the folder back and reactivate it. The same trick works for a security plugin that moved your login page; our plugin conflict guide covers renaming folders in more detail.

Troubleshooting and Things to Watch For

• Page caching: if you use a page cache other than WP Rocket, the WPS Hide Login docs say to add your login slug to the never-cache list. Do the same for a CDN that caches HTML, such as a Cloudflare cache-everything rule, or visitors can get a cached login page or a redirect loop.
• Multisite: WPS Hide Login works with subdomain and subfolder networks. Network activation gives you a network-wide default under Network Settings, and each site can still set its own slug. ASE does not officially support multisite.
• Hardcoded links: plugins or themes that hardcode wp-login.php instead of using wp_login_url() will send people to a 404.
• Comment login links: if “Users must be registered and logged in to comment” is enabled, the plugin warns that the login link in the comment form is not hidden.
• A 404 on the new URL: re-save your permalinks under Settings > Permalinks to flush the rewrite rules, then try again in a private window.

Frequently Asked Questions

Hiding the login page is one quick piece of a layered setup. Change the URL, bookmark it, and then spend the time that matters on 2FA and rate limiting.