How to Hide wp-login.php on a WordPress Site

Why people hide the login page

A default WordPress site accepts sign-ins at /wp-login.php, and anything under /wp-admin/ sends signed-out visitors there. Attackers do not need to find your login page. They already know where it is on every WordPress site on the internet.

Most of the traffic that hits it is automated: bots trying leaked passwords, common passwords, or the username admin. Even when they fail, they fill your logs, slow your server and make real warning signs harder to spot.

Moving the login page to an address only you know takes most of that noise away. The bots simply do not find a door to try.

What hiding the login page does and does not do

Hiding the login page is a form of obscurity. It reduces automated noise and removes the easiest target, but it is not a lock. A determined attacker who learns your new address is back to guessing passwords.

It also does not cover every way into WordPress. Other entry points can accept credentials without touching the login page, so a hidden login on its own is not a complete defence.

• It helps: less bot traffic, quieter logs, fewer lockout emails, less server load from failed sign-ins.
• It does not help with: stolen passwords that are used at the right address, or credentials sent to XML-RPC and the REST API.
• It works best as one layer next to strong passwords, two-factor sign-in and limits on failed attempts.

Before you change anything

Changing how sign-in works is one of the few security changes that can lock you out completely. Prepare a way back first.

1. 1Make a fresh backup of the files and the database.
2. 2Make sure you have SFTP or file manager access to your hosting, so you can rename a plugin folder or edit a file if something goes wrong.
3. 3Pick a new address made of lowercase letters, numbers and hyphens. Avoid obvious words such as login, admin, dashboard or signin.
4. 4Open a private browser window to test the new address, so your normal signed-in session does not hide a problem.

Method 1: Hide wp-login.php with a plugin

A security plugin can serve the login form at an address you choose and return something harmless, such as a 404 page, at /wp-login.php and /wp-admin/ for people who are not signed in. This is the method most site owners should use, because it also updates the sign-out, lost-password and registration links for you.

1. 1Install a plugin that supports a custom login address and open its login settings.
2. 2Enter your new slug, for example team-door, so your login page becomes yoursite.com/team-door.
3. 3Choose what visitors to the old address see. A 404 page gives bots the least to work with.
4. 4Save, then copy the full new address and bookmark it before you sign out.
5. 5In a private window, check that the new address shows the login form and that /wp-login.php does not.
6. 6Request a password reset email and make sure the link inside it opens the new address.

Method 2: Restrict the login file at the server

If you control your web server, you can put a gate in front of wp-login.php instead of moving it. The two common gates are an IP allow list and a username and password prompt from the server itself, which sits in front of WordPress.

This is strong because bots are stopped before PHP runs. It suits sites where only a few staff members sign in from known places. It is a poor fit for membership or shop sites where customers need to sign in, and a password reset will also hit the gate, so reset links will not work for people outside it.

<Files wp-login.php>
  Require ip 203.0.113.10
</Files>

# Or ask for a server-level username and password instead:
# <Files wp-login.php>
#   AuthType Basic
#   AuthName "Restricted"
#   AuthUserFile /home/youruser/.htpasswd
#   Require valid-user
# </Files>

What visitors to the old address should see

Most plugins let you choose between a 404 page, a redirect to the home page, a redirect to a page you pick, or a redirect to any address.

A 404 is the quietest choice because it looks as if no login page ever existed. A redirect to the home page is friendlier if real people often type the old address. Whichever you pick, test it after every plugin or theme update.

Things that can break

Moving the login page touches more than one screen. Check these after you switch it on.

• Membership, shop and course plugins that link to /wp-login.php directly. Update their login address setting.
• Caching plugins and CDNs that cache the login page. Exclude the new address from caching.
• Password-protected posts, because WordPress sends the post password through the login file.
• Bookmarks, saved links in team documents and monitoring tools that sign in on a schedule.
• Multisite networks, where every site shares one login and the rules are different.

If you lock yourself out

The fastest way back is to turn the plugin off from the file system. Connect by SFTP or open your host's file manager, go to wp-content/plugins/ and rename the plugin's folder, for example from my-login-plugin to my-login-plugin-off. WordPress then deactivates it and the normal /wp-login.php works again.

Once you are back in, fix the setting, rename the folder back and test in a private window before you sign out.

Add the layers that matter more

A hidden login page is a good first layer, but these protect you when someone finds the door anyway.

• Two-factor sign-in for every administrator and editor.
• Lockouts for addresses that keep guessing wrong.
• Long, unique passwords stored in a password manager.
• One vague error for a wrong username or a wrong password, so nobody can confirm which accounts exist.