On a single ordinary Monday in May 2026, security researchers counted 4.36 million blocked requests aimed at one file — wp-login.php — in just 24 hours. That was not a targeted attack on one big site. It was background noise: bots knocking on the same door on thousands of WordPress sites, all day, every day.
Your site has that same door at the address every bot already knows: yoursite.com/wp-admin. Learning how to change your WordPress login URL moves it somewhere only you know — and most of the noise stops showing up.
The short version: install the free WPS Hide Login plugin, pick a secret slug like /my-door-4821, and your old login address returns a 404. Five minutes, zero cost, fully reversible.
Why Your Default WordPress Login URL Is a Magnet for Bots
WordPress powers about 43% of all websites (W3Techs 2026), so attackers scan millions of domains and try the same two addresses — /wp-admin and /wp-login.php — on every one of them.
Every WordPress site ships with the same login address, so bots never have to guess where to knock. Once they find it, they guess passwords — “admin” with “123456,” then thousands of dictionary combinations and leaked passwords. One unthrottled IP can test tens of thousands a day.
A small WooCommerce store in a 2025 Sucuri report faced 47,000 failed login attempts in one day from 1,200 unique IP addresses across 50 countries — enough to spike its CPU to 100% and trigger a hosting suspension. It was not famous or targeted; the bots found it within hours of going live. Every failed login runs PHP and hits your database, slowing your whole site on shared hosting.
How to Change Your WordPress Login URL With WPS Hide Login
The easiest method is the free WPS Hide Login plugin: more than 2 million active installations, a 4.8 out of 5 star rating from over 2,100 reviews on WordPress.org, last updated in August 2026. It intercepts login requests without renaming core files, so deactivating it restores your site exactly.
Step 1: Install and activate the plugin
From your dashboard, go to Plugins → Add New, search for WPS Hide Login, and click Install Now, then Activate.
Step 2: Pick your secret slug
In Settings → General, scroll to the Login url field and type a slug that is hard to guess — my-door-4821, not login or admin. Avoid dictionary words; bots try those first.
Bookmark your new URL immediately, and save it in your password manager. From now on, yoursite.com/wp-admin and yoursite.com/wp-login.php return a 404 to logged-out visitors.
Step 3: Test it before you log out
Open a private window, visit your new address, and confirm you see the login form. Then visit the old address and confirm a 404. Only then log out and log back in through the new URL.
Key takeaway: the plugin method takes five minutes, changes nothing permanent, and works on any WordPress site — which is why it is the right choice for almost everyone.
How to Change Your WordPress Login URL Without a Plugin
Want to change your WordPress login URL without a plugin? Use a small custom plugin — not your theme’s functions.php, which is wiped out on the next theme update. Core-file edits get overwritten by WordPress updates too.
Back up your site first, and test on staging if you have one. A mistake here can lock you out of your own dashboard.
In your file manager or via FTP, create the folder /wp-content/plugins/custom-login-url/ and a file inside it called custom-login-url.php with this code (replace my-secret-door with your slug):
<?php
/* Plugin Name: Custom Login URL */
define( 'MY_LOGIN_SLUG', 'my-secret-door' );
add_filter( 'login_url', function( $url ) {
return home_url( '/' . MY_LOGIN_SLUG . '/' );
} );
add_action( 'init', function() {
$request = trim( parse_url( $_SERVER['REQUEST_URI'], PHP_URL_PATH ), '/' );
if ( 'wp-login.php' === $request || 'wp-admin' === $request ) {
status_header( 404 );
exit;
}
} );
Activate it under Plugins → Installed Plugins, then visit Settings → Permalinks and click Save Changes. Test the new address in a private window.
Key takeaway: the code method gives you full control and zero plugin overhead — but you own the maintenance. Unless you read PHP and can recover via FTP, stick with WPS Hide Login.
The Advanced Route: Lock Down wp-login.php With .htaccess
On Apache or LiteSpeed hosting, you can restrict wp-login.php to your IP address with .htaccess — the strongest method, and the easiest to break your site with.
Add this to the .htaccess file in your WordPress root (replace 123.45.67.89 with your real IP):
<Files wp-login.php>
Order Deny,Allow
Deny from all
Allow from 123.45.67.89
</Files>
Do not use this if your IP address changes often — most home connections rotate IPs, and you will lock yourself out. Back up .htaccess first: one typo can take down your entire site.
Plugin vs. Code vs. .htaccess: Which Method Should You Pick?
| Method | Difficulty | What it actually does | Best for |
|---|---|---|---|
| WPS Hide Login plugin | Easy (5 minutes) | Hides the login page; old URLs return 404 | Almost every site owner |
| Custom plugin (code) | Hard | Same idea, but you write and maintain the redirect logic | Developers who avoid extra plugins |
| .htaccess IP allowlist / password | Advanced | Blocks wp-login.php at the server level | Sites with a fixed IP or a sysadmin |
The plugin wins for a small site on speed, safety, and reversibility. Use code only if you prefer owning the logic, and .htaccess as an extra layer — not as your first move.
The Honest Caveat: Hiding Your Login Is Not Real Security
Changing your login URL is security through obscurity — it hides the door, it does not lock it. A determined attacker can still find your custom URL from server logs or a leaked link. It stops the bots that only knock on default addresses, which is most of the noise, but not a targeted attack.
Treat the hidden login as one layer, never as the whole plan. Pair it with a strong unique admin password, two-factor authentication, a plugin that limits login attempts, and regular updates. For the full layered checklist, read our guide on how to secure your WordPress site without a plugin and our breakdown of how to protect WordPress from brute-force attacks.
What to Do If You Forget Your Custom Login URL
The fix is simple: turn off the thing that moved the door.
If you used WPS Hide Login, open your file manager or FTP and rename the wp-content/plugins/wps-hide-login folder to wps-hide-login-off. WordPress deactivates any plugin whose folder it cannot find, and /wp-admin works again immediately.
If you used the code method, rename or delete your custom-login-url folder the same way. If you used .htaccess, remove the block you added — this is why you kept a backup before editing it. Save the new URL in your password manager the moment you create it.
FAQ
What is my WordPress login URL?
By default, it is yoursite.com/wp-admin or yoursite.com/wp-login.php — both lead to the same login form. If a plugin changed it, the address is whatever custom slug was set instead, and the defaults return a 404.
Can I change my WordPress login URL without a plugin?
Yes. Build a small custom plugin using the login_url filter that redirects direct hits on wp-login.php to a 404, or use .htaccess rules on Apache hosting. Both need care: back up first and test on staging. For most owners, the free WPS Hide Login plugin is faster and safer. The official login_url filter documentation explains how the hook works.
What happens if I forget my custom login URL?
Nothing permanent. Rename the plugin folder via FTP or your file manager — for WPS Hide Login, rename wp-content/plugins/wps-hide-login — and WordPress deactivates it, restoring /wp-admin. Log in and set a new slug.
Does changing the login URL stop hackers?
It stops most automated bots: the WEDOS security team logged 4.36 million blocked requests to wp-login.php in a single day in May 2026, nearly all of it automated. But it does not stop a determined attacker who finds your custom URL. Combine the hidden login with two-factor authentication, login attempt limits, and strong passwords — see the WordPress hardening guide for the full checklist.
Hide the Door, Then Lock It
Changing your WordPress login URL is fast, free, and reversible: five minutes with WPS Hide Login, and thousands of daily bot knocks stop arriving. Pair the hidden door with two-factor authentication and login limits, and your site goes from an easy target to a waste of a bot’s time. If you would rather have a professional handle it, see our WordPress security services or get in touch.
