TLDR: I learned how attackers find WordPress admin pages the hard way. Hiding the login URL (and tightening access to wp-admin) dramatically reduced bot noise and brute force attempts on my site. In this guide I walk you through safe methods to hide or change your login path, the pros and cons of each approach, exact step-by-step instructions, what to avoid, and quick troubleshooting tips so you can secure your site without breaking access for legitimate users.
Why I decided to hide my login URL
I will start with a short story. A few years ago I started getting constant login attempt emails and saw thousands of hit attempts on /wp-login.php and /wp-admin every day. I was tired of chasing IP blocks and felt like I was playing whack a mole with bots. That is when I decided to hide my login page. The change reduced the noise, lowered server load, and gave me breathing room to apply better security controls.
What is hiding the WordPress login URL?
Hiding your login simply means changing or masking the default paths that WordPress uses like /wp-login.php and /wp-admin so they are not easy for automated scanners to find. You do not remove the login functionality. You only make the entry point less obvious to attackers and bots, which reduces automated attacks and brute force attempts.
Why does it matter?
Here is why hiding the login can be important:
- Reduces automated attacks: Many attacks target standard endpoints. Moving the endpoint cuts down the volume of low effort attacks.
- Lower server load: Fewer bot requests means fewer PHP processes and less bandwidth used on your login page.
- Extra layer of security: It is security by obscurity, but when combined with strong passwords and MFA it becomes an effective deterrent.
- Better logs and alerts: When noise is lower, real threats stand out in your logs and monitoring tools.
How do you hide the login URL safely?
Let me break the practical methods down with pros, cons, and exact steps. I used these on my site in the order below and they worked together well.
Method 1: Use a reputable plugin (recommended for most users)
Plugins are the fastest and safest route because they handle rewrite rules for you and often include whitelist and lockout features. Popular plugins change the login URL without altering core files.
- Pros: Easy to set up, reversible from the dashboard, feature rich (login limits, logging, captcha).
- Cons: Adds another plugin to maintain. A misconfigured plugin can lock you out if you forget the new path.
Basic steps I followed:
- Install a well rated plugin from the WordPress directory that can change the login slug.
- Pick a unique path that is memorable to you but hard to guess, for example /my-secret-login-2026.
- Activate the plugin and change the login slug in its settings. Test the new URL in an incognito window to ensure it works.
- Keep a backup of the plugin settings or a screenshot of the new login path in a secure password manager.
Method 2: Move wp-login.php via rewrite rules
If you prefer not to use a plugin you can create rewrite rules in your web server configuration. This method is more technical and I only recommend it if you are comfortable with server files and have a backup.
- Pros: No extra plugin dependency, can be fast and lightweight.
- Cons: Risk of locking yourself out if rules are wrong; requires server access and careful testing.
General approach I used:
- Create a rewrite rule in nginx or Apache that maps a custom path to /wp-login.php.
- Test thoroughly with an incognito browser and from different IPs if you can.
- Keep a working SFTP session open while you test so you can revert changes quickly if needed.
Method 3: Limit access to wp-admin by IP and user role
This is one of my favorite defensive moves. Restricting who can reach the admin area is powerful and simple for small teams.
- Pros: Blocks most external traffic to wp-admin; simple with basic firewall rules or .htaccess.
- Cons: Not ideal for editors working from many locations; you must update allowed IPs when traveling.
How I set it up:
- For Apache: use an .htaccess rule to allow only specific IP addresses to access /wp-admin.
- For nginx: add allow and deny rules in the server block targeted at /wp-admin.
- Combine this with role checks in WordPress so subscribers and public users cannot access wp-admin pages.
Method 4: Two-factor authentication and strong passwords
Hiding the login is not a replacement for strong authentication. After I hid my login, I enforced two factor auth across all admin accounts to ensure that even if the login page was discovered, attackers could not get in.
- Pros: MFA defends against credential theft and password reuse.
- Cons: Slight friction for users, but modern methods like push notifications make it tolerable.
How I tested my changes without locking myself out
Here are the safeguards I always use and recommend so you do not lose admin access:
- Keep a separate admin account with a known email and password during tests.
- Open an SFTP or hosting control panel session so you can revert plugin or config changes quickly.
- Test in a private browser window and clear cookies between tests.
- Document new login paths in a secure vault. If you forget the path, you will thank yourself for the note.
What should you avoid?
Let me be clear about common mistakes I have seen and experienced:
- Do not edit core WordPress files such as wp-login.php directly. Core edits break on update and are error prone.
- Do not use insecure or abandoned plugins. Check plugin updates and reviews before installing.
- Avoid overly complex rewrites without backups. Always test rewrites in a staging environment first.
- Do not rely solely on hiding the URL. Combine it with MFA, strong passwords, and least privilege user roles.
Quick troubleshooting
If you get locked out, here is what worked for me:
- Access your site via SFTP and rename the plugin folder that changed the login path. This disables the plugin and restores the default login URL.
- If you used rewrite rules, revert the file or configuration and reload the server. Keep backups of your original configs for quick rollback.
- Check error logs to identify plugin conflicts or PHP errors that might prevent login pages from loading.
Maintenance and monitoring tips
Security is ongoing. These simple routines helped me keep the login area tidy and monitored:
- Rotate admin passwords and require unique, strong passwords for all accounts.
- Enable two factor authentication for every admin and editor account.
- Schedule weekly log reviews. When traffic to the login page spikes, investigate immediately.
- Keep WordPress, themes, and plugins updated and purge stale user accounts.
How does hiding the login interact with caching and CDNs?
When you change login paths remember to:
- Clear caches after changes so the old route is not served from cache.
- If you use a CDN, add the new path to any rules that bypass caching or apply security rules to the admin area.
After I made changes I always purge cache WordPress to ensure the new URL behaved correctly and to avoid being served outdated responses when testing.
Frequently asked questions
Will hiding the login URL break plugins or REST API?
In most cases good plugins continue to work. However, some plugins hook into wp-login.php directly. Test critical functionality after any change. If a plugin depends on the default path you may need to whitelist it or choose a different plugin. For API consumers, ensure you do not block legitimate REST API endpoints when restricting access to wp-admin.
How do I recover if I forget my custom login path?
If you forget the path, disable the plugin via SFTP by renaming its folder or revert server rewrite rules. That will restore the standard /wp-login.php and /wp-admin routes so you can regain access and reconfigure safely.
Is hiding the login URL enough to secure a WordPress site?
No. Hiding is one layer among many. I treat it as a first filter to reduce automated noise. Combine it with strong passwords, two factor authentication, role management, limited access to wp-admin, and regular updates for comprehensive security.
Can I hide the login URL on a multisite installation?
Multisite is trickier. Some plugins do not support multisite out of the box. For multisite networks I strongly recommend testing in a staging environment and choosing solutions known to support multisite. When in doubt, restrict access to the network admin area by IP and use MFA for network administrators.
Where else should I look for help?
If you need step by step guidance on managing admin access and login points, the guide on https://wpoptimizers.com/how-to-login-to-wordpress-admin/ explains admin access best practices. Also, if you need to hide non public pages, check this practical walkthrough on how to hide WordPress page which complements login hiding strategies.
To summarize, hiding your login URL reduces noise and adds a useful layer of defense. However, the true security gains come when you combine it with multi factor authentication, strong user management, and regular maintenance. I implemented these steps on my sites and saw immediate reductions in unwanted login attempts and server load. Try the plugin route first if you are not comfortable with server configs, and always keep a recovery plan ready.