How to Change Your WordPress Login URL to Hide It From Brute-Force Attacks

By default, every WordPress site uses the same login address: yourdomain.com/wp-login.php or yourdomain.com/wp-admin. Because that address never changes from site to site, automated bots scan it constantly, trying username and password combinations around the clock. Moving your login page to a custom, unpredictable address removes your site from that automatic scanning without touching anything else on your site.

Why This Helps

Changing your login URL does not make your password stronger, and it is not a replacement for other protections. What it does is stop the huge volume of generic bots that only know how to find the default WordPress login address. Fewer login attempts also means a cleaner security log, so it is easier to notice a real attack if one ever happens.

This technique is sometimes called "security through obscurity." Use it as an extra layer alongside a strong, unique password and two-factor authentication, not instead of them.

Changing Your Login URL With a Plugin

WordPress does not include this option by default, so you will need a small plugin. A widely used free option is WPS Hide Login, though several similar plugins work the same way.

1. Log in to your WordPress dashboard and go to Plugins, then Add New Plugin.
2. Search for a login URL plugin such as WPS Hide Login, then click Install Now followed by Activate.
3. Open the plugin's settings page, usually found under Settings in your dashboard menu.
4. In the Login URL field, type a custom slug that is easy for you to remember but not guessable, for example "staff-access" instead of "login" or "admin".
5. Click Save Changes.

Once saved, open your new address in a private or incognito browser window to confirm it loads the normal WordPress login form. Save it in your password manager or browser bookmarks right away.

As soon as the plugin is active, the standard wp-login.php and wp-admin addresses stop working for anyone, including you. If you forget your new login address, you will need File Manager or FTP access to get back in.

If You Get Locked Out

If you lose track of your custom login address, you can disable the plugin directly through your files to restore the default address:

1. Open File Manager in your hosting control panel, or connect using an FTP client.
2. Navigate to public_html/wp-content/plugins.
3. Find the folder for the login plugin (for example, "wps-hide-login") and rename it, for example by adding "-disabled" to the end.
4. WordPress will now treat the plugin as broken and deactivate it automatically, restoring the default wp-login.php address.
5. Log in normally, then rename the folder back to its original name and reconfigure the plugin with a login address you will remember.

Combine This With Other WordPress Login Protections

A hidden login URL works best alongside your site's other login defenses:

• A plugin that limits repeated failed login attempts, so a bot that does find your login page still gets locked out quickly.
• Two-factor authentication on your WordPress login, so a stolen password alone is not enough to get in.
• A strong, unique admin password that is not reused on any other site.
• Keeping WordPress core, your theme, and all plugins updated.

For more on blocking repeated login attempts directly, see How to Limit Login Attempts and Protect Your WordPress Login from Brute-Force Attacks.