Change your WordPress login URL and hide wp-login.php

Why the default WordPress login URL gets attacked

Every WordPress site signs in at the same address: your site name followed by /wp-login.php, with the admin area at /wp-admin. Anyone can guess that, and so can every robot on the internet.

Most attacks on WordPress are not people. They are robots that visit thousands of sites a day and try passwords at the usual address. Each attempt makes your server do work, and the noise buries the few events in your log that matter.

A custom login URL does not replace a strong password. It takes your site off the automated lists, so far fewer guesses ever arrive. It works best alongside two-factor sign-in and lockouts: a hidden door is good, and a hidden door with a good lock is better.

How Stack Guard changes your WordPress login URL

Stack Guard intercepts requests instead of renaming core files, so WordPress itself is untouched and updates keep working. Once the custom address is on, anyone who is not signed in and visits /wp-login.php or /wp-admin gets the response you chose, not a sign-in page.

Your sign-out, lost password and registration links, and the links in password reset emails, update themselves to the new address.

• Open the Login tab and switch on Custom Login URL, then type a slug such as team-door. Use lowercase letters, numbers and hyphens, and avoid obvious words like login or admin.
• Choose what people see at the old address: a 404 page (the safest choice), a redirect to your home page, a WordPress page you pick, or any address you type.
• Optional access token: a secret word on the end of your sign-in address. Without it, even someone who knows your slug gets the blocked response. Remember the device for a number of days, or ask again every browser session.
• Optional honeypot: an invisible box on the sign-in form. People never see it, robots fill it in, and the robot is told the password was wrong. You see it in the activity log as a blocked honeypot.
• Save, then copy your new address from the top of the Login tab and bookmark it before you sign out.

Hide wp-login.php without locking yourself out

The custom login URL, access token and honeypot are in Stack Guard Free, and they keep working if a paid plan ends, so changing plans can never lock you out. It suits every site, and it is most useful on sites whose logs fill up with failed sign-ins.

Settings that can lock people out carry a Test After Changing marker. After you save, open your site in a private window and check you can sign in. If you forget the address, sign in at /wp-login.php after adding the recovery line to wp-config.php, look up the address, then remove the line.

A few things are worth knowing. When you are already signed in, opening the sign-in address shows a not found page, which is normal: go to /wp-admin instead. Some membership or login plugins expect the usual address, so give them the new one in their settings. If you use password-protected posts, their page code contains your sign-in address, so add an access token if that matters to you.

Vague errors and the rest of sign-in security

Half of a password guess is the username. With Hide Login Error Details on, a wrong username and a wrong password show the same message, so a robot cannot tell when it has found a real account. Lockout, CAPTCHA and two-factor messages still show as normal so real people know what to do. This is in every plan.

Pro adds more layers on the same tab.

• CAPTCHA on sign-in, registration, password reset and comments, with Cloudflare Turnstile or Google reCAPTCHA (Pro).
• Idle sign-out and your own Remember Me length (Pro).
• Magic-link unban, so a real person who is locked out can free themselves by email (Pro).