Change the WordPress Login URL
WordPress logs in at /wp-login.php until you change it. Install one login-hiding plugin such as WPS Hide Login, enter a private slug, save, and test it in a private window before logging out. If you get locked out, rename the plugin folder over FTP and /wp-login.php works again.
For WordPress site owners who want fewer bot login attempts without risking a dashboard lockout.
knowledge
- Read time
- 4 min
- Sections
- 6
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026.
What is the default WordPress login URL?
Every WordPress site answers at yourdomain.com/wp-login.php, and visiting /wp-admin while logged out redirects there. If WordPress is installed in a folder, the folder stays in the path, for example example.com/blog/wp-login.php.
This path is not set under Settings → General. The WordPress Address and Site Address fields there move the whole site; changing them does not hide the login form and can break the site if entered wrongly.
Why change the WordPress login URL?
Because the default path is identical on almost every WordPress site, automated scripts post username and password guesses to /wp-login.php around the clock. A private login address makes those requests hit a 404 instead of the form, cutting log noise and server load.
It is a reduction in noise, not a lock. Anyone who learns the new address can still try passwords, so pair it with two-factor authentication and a limit on failed attempts, covered at the end of this guide.
Which method should you use to change it?
Use one login-hiding plugin that serves the form at your chosen slug and blocks the old paths; do not rename core files or stack two plugins. The other approaches either leave the real file reachable or break on updates.
| Method | Result | Problem |
|---|---|---|
| One hide-login plugin (e.g. WPS Hide Login) | Form at your slug; /wp-login.php and /wp-admin blocked for logged-out visitors | Conflicts if a second plugin also rewrites login |
| Security plugin’s own login-URL setting | Same result inside a plugin you already run | Do not add a separate hide-login plugin as well |
| Rewrite rule pointing a short URL at wp-login.php | A friendlier address | The real file stays public, so bots still reach it |
| Renaming wp-login.php | Looks hidden | The next core update restores the file; missed references lock you out |
How do you set a new login URL with WPS Hide Login?
Install the plugin, enter a new slug under Settings → General → WPS Hide Login, save, and test the new address in a private window before you log out. Take a backup first; the WordPress backup plugins guide lists options.
- Go to Plugins → Add New, search for WPS Hide Login, click Install Now, then Activate.
- The plugin opens its settings after activation; later you find them under Settings → WPS Hide Login, a section at the foot of Settings → General.
- In Login url, type a slug you have not used anywhere public; avoid obvious words such as login, admin or dashboard.
- Leave Redirection url on its default 404 page, or point it at your homepage, and click Save Changes. Stay logged in.
- In a private window, open yourdomain.com/your-slug and sign in. Then try /wp-login.php and /wp-admin; both should go to the redirect, not the form.
- Bookmark the new address and store it in your password manager.
Tell every editor and author about the change, and update any links in your theme or emails that point to wp-login.php. WooCommerce customers who log in through the My Account page are not affected. If you use a page-caching plugin other than WP Rocket, add the new slug to its never-cache list, as the plugin’s documentation advises.
What do you do if the new login URL locks you out?
Deactivate the hide-login plugin from outside WordPress; /wp-login.php works again as soon as the plugin is off. There is no need to edit the database first.
- File manager or FTP: open
wp-content/plugins/and renamewps-hide-logintowps-hide-login-off. The cPanel File Manager guide shows where. - WP-CLI:
wp plugin deactivate wps-hide-login, or read the saved slug withwp option get whl_page. - After logging in: rename the folder back, reactivate, and set the slug again.
A 404 straight after a correct password usually means two plugins are rewriting the login, or a two-factor plugin still posts to the old path. Disable one, confirm the slug works, then re-enable the other. On WebJi® hosting, email support@webji.services if you need help with the file manager; replies come 24/7 in Hindi and English.
What else protects the WordPress login?
Two-factor authentication, a cap on failed login attempts and disabling unused XML-RPC do more than a hidden URL, because they work even when an attacker knows the address. Add them after the slug test passes.
- Two-factor authentication for every administrator and editor — see WordPress two-factor authentication.
- Limit login attempts and temporarily block repeat offenders — see limit login attempts in WordPress.
- XML-RPC: it accepts password attempts on a different path; switch it off unless the WordPress mobile app or a remote publishing tool needs it, as explained in disable XML-RPC in WordPress.
- Strong unique passwords and no account named “admin”; change the WordPress admin password if it was ever shared.
For the full list, use the WordPress security checklist, or have WebJi® WordPress security services set it up.
Frequently asked questions
Does changing the login URL affect SEO?
No. Search engines do not index the login page in a useful way, and public pages, URLs and sitemaps stay the same. Make sure the new slug does not clash with an existing page or post, or that page will stop loading normally.
Will the new login URL work on a multisite network?
Yes. WPS Hide Login works with subdomain and subfolder networks. Network activation sets a network-wide default slug, and individual sites can still choose their own. On multisite the saved slug lives in the sitemeta table if it is not in a site’s options table.
Do I still need a login-hiding plugin if my host blocks brute force?
It is optional then. Server-level protection already throttles repeated failures; a custom slug mainly reduces log noise and wasted requests. Two-factor authentication remains the more important step either way, because it protects the account even when a password leaks.
Can I change the login URL without any plugin?
Not safely. Server rewrite rules can add a friendly address but leave wp-login.php reachable, and renaming the core file is undone by updates. Password-protecting wp-login.php with HTTP authentication at the server is a plugin-free alternative that genuinely blocks access.
Last editorial update: 14 November 2026.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.