Login Security
How to Change Your WordPress Login URL Away From wp-admin
Every default WordPress install answers to /wp-admin and /wp-login.php, which is exactly what automated scanners check first. Moving the login page to a custom address quietly removes it from their target list.
24/7
Support if a login URL change goes wrong
Free
Auto-renewing SSL on every plan
Daily
Backups before making login changes
30-Day
Money-back guarantee
In short
Changing the WordPress login URL means using a plugin to replace the default /wp-login.php and /wp-admin addresses with a custom slug you choose, so anyone visiting the old address gets a 404 page instead of a login form. This doesn't replace strong passwords or two-factor authentication, but it does stop the huge volume of automated bots that only ever check the default address, cutting login-page traffic and server load.
Nearly every WordPress site on the internet uses the same two login addresses, /wp-admin and /wp-login.php, which makes them the first thing any automated scanner checks when it finds a site running WordPress. That default is convenient for site owners but just as convenient for bots that never have to guess where the login form lives.
Moving the login page to a custom URL, something like /my-secret-login instead of /wp-login.php, removes the site from the pool of targets that respond to the default scan. It's a low-effort change with a real reduction in login-page traffic, though it works best as one layer alongside attempt limiting and two-factor authentication rather than a replacement for either.
Why Bots Default to /wp-login.php and /wp-admin
Automated scanning tools work at scale, checking many domains for the same handful of default addresses rather than analyzing each site individually. Because WordPress ships with /wp-login.php and /wp-admin unchanged on the vast majority of installs, those two paths are the highest-value default check a scanner can run.
This is why login-page traffic on an unmodified WordPress site often includes far more bot visits than real ones, well before any password guessing even starts. Each of those requests still costs a small amount of server processing, and at scale that adds up to noticeable load on a site with no other login protections in place.
Changing the Login URL With a Plugin
A dedicated plugin intercepts requests to the default login addresses and instead serves the login form at a custom slug you choose, while returning a standard 404 not-found page for anyone who still tries /wp-login.php or /wp-admin directly. Setup is typically a single settings screen: pick a new slug and save.
Choose something specific to you rather than another common guess like /login or /admin-panel, since a slug that's itself commonly used defeats some of the purpose. Bookmark the new address immediately, since the standard WordPress login link in browser bookmarks or password managers will otherwise point to a page that now returns a 404.
Testing the New URL Before You Log Out
Before closing the current browser session, open a separate private or incognito window and confirm the new login URL loads the form correctly and accepts your credentials. This catches a misconfiguration, like a caching plugin serving a stale version of the old login page, while you still have an active session to fix it from.
Also confirm that the old /wp-login.php address now returns a 404 rather than still working, since some setups only add the new URL without disabling the old one, which defeats the purpose of the change entirely.
What to Do if You Get Locked Out
If the new URL doesn't load and the old one is already disabled, access the site's files through the hosting control panel's file manager or FTP and either deactivate the login-URL plugin by renaming its folder, which reverts the login address back to default, or check the plugin's settings file for the slug that was saved.
A recent daily backup is the safety net here too: restoring the site to the state just before the change is a fast way to recover access if a manual fix through file access isn't working, and 24/7 human support can talk through the file manager steps in real time.
Support and Backups if a Login Change Goes Sideways
Changing something as central as the login URL always carries a small risk of a mistyped setting locking you out at an inconvenient time. Daily backups mean the site can be restored to exactly how it was minutes before the change.
24/7 human support means there's someone to talk through the hosting control panel's file manager with you in real time, rather than troubleshooting alone through documentation late at night.
- Daily backups to restore the pre-change state instantly
- 24/7 human support for real-time file manager guidance
- cPanel-style panel with file manager and FTP access built in
- Free auto-renewing SSL protecting the new login page too
Why Hosting Cheap
What you get
Daily Backups
Restore the site to its pre-change state in minutes if a login URL edit goes wrong.
24/7 Human Support
Get real-time help through the file manager if a lockout happens outside business hours.
cPanel-Style Panel
File manager and FTP access make it straightforward to revert a plugin manually if needed.
Free Auto-Renewing SSL
The new login address stays encrypted just like the default one was.
NVMe SSD + LiteSpeed
Less bot traffic hitting the login page means more server capacity for real visitors.
30-Day Money-Back Guarantee
Test a hosting setup built to make these changes low-risk, with support on hand.
How It Works
Get set up in a few steps
Install a login URL plugin
Choose a plugin that lets you set a custom slug for the login page.
Set and bookmark the new address
Pick a slug that isn't itself a common guess, save it, and update saved bookmarks.
Verify in a private window before logging out
Confirm the new URL works and the old one 404s while your current session is still active.
Included
Everything you need, on every plan
- Back up the site before changing the login URL
- Install a plugin to set a custom login slug
- Choose a slug that isn't a common guess itself
- Test the new URL in a private browser window first
- Confirm the old wp-login.php address now 404s
- Update bookmarks and password manager entries
- Keep file manager or FTP access handy in case of lockout
FAQ
Frequently asked questions
Does changing the WordPress login URL make the site fully secure?
No, it reduces automated bot traffic to the login page but doesn't replace strong passwords, two-factor authentication, or attempt limiting. It's one layer among several, most useful for cutting down the volume of generic scanning a site receives.
What happens if I forget my new login URL?
As long as you have file manager or FTP access to the site, you can deactivate the plugin by renaming its folder on the server, which reverts the login address back to the default /wp-login.php so you can log in again.
Can I still use the WP-CLI or REST API after changing the login URL?
Most login-URL plugins only affect the browser-based login form and leave WP-CLI, REST API endpoints, and XML-RPC untouched, though the exact scope depends on the specific plugin, so check its documentation for anything that connects to the site programmatically.
Will this break email links that point to wp-admin?
Notification emails and some plugin links may still point to the old /wp-admin address after the change, and depending on the plugin these may redirect correctly or return a 404, so it's worth testing a few common email links after making the switch.
Is it risky to change the login URL on a live site?
It carries some risk of a temporary lockout if something is misconfigured, which is why testing the new address in a private browser window before closing the current session, and having a recent backup on hand, are both worth doing first.
Should I combine this with limiting login attempts?
Yes. Changing the login URL cuts down generic bot scanning, while limiting login attempts protects the login form itself from anyone who does find the new address, so the two work well as complementary layers.
Change Your Login URL With a Safety Net in Place
Daily backups and 24/7 human support mean a login change is never a permanent risk.
Get Started