How to Change Your WordPress Login URL (2026): Plugin + Manual Methods
Your /wp-admin login is the first thing bots attack. Change your WordPress login URL with WPS Hide Login or manually with code, plus the security to pair.
The fastest way to change your WordPress login URL is the free WPS Hide Login plugin: install it, open Settings, General, set a custom slug like /secure-login-9f3, and save. You can also do it manually in .htaccess, but that breaks on updates. Changing the URL stops automated bots, but it is security through obscurity, so pair it with strong passwords, two-factor login, and brute-force limits.
On this page
- TL;DR
- What is the default WordPress login URL?
- Why change your WordPress login URL?
- The methods at a glance
- Change it with WPS Hide Login (the easy way)
- Change it with an all-in-one security plugin
- Change it manually with code
- Changing the URL is not enough: pair it with real security
- Common problems and fixes
- Final take
- Common questions
Open any WordPress site, add /wp-admin to the domain, and you hit the login screen. Every site. Same door, same handle.
That predictability is the problem.
Bots know it too. They hammer /wp-admin and /wp-login.php all day, trying password after password. On my own sites, the login page was easily the most-hit URL before I did anything about it.
Changing the login URL is the simplest fix, and it takes about five minutes. I have done it on my own sites and on client builds, both with a plugin and by hand.
This guide is both ways: the easy plugin route, the manual code route, plus the one honest caveat nobody mentions and the security you actually have to pair it with.
What is the default WordPress login URL?
Every WordPress install ships with the same two login paths:
yoursite.com/wp-adminyoursite.com/wp-login.php
They both open the same login form, and they are identical on every WordPress site on the planet. That is the whole issue. A bot does not have to guess where your login is, because it already knows.
Why change your WordPress login URL?
The default login is a fixed target for brute-force attacks, where bots run through thousands of username and password combinations hoping one sticks.
Even when they fail, they cost you. The constant requests eat server resources and slow the site down.
Move the login to a slug only you know, and most of those bots hit a 404 and give up.
The honest caveat: this is obscurity, not armour
Changing your login URL is security through obscurity. It hides the door, it does not lock it. It stops automated bots cold, which is most of the noise, but a determined attacker aiming at your site specifically can still find a custom URL.
So treat this as one layer, not the whole defence. The security section below covers the rest.
Back up first
Before you touch logins or core files, take a full backup with a free plugin like UpdraftPlus. If a change ever locks you out, a backup is the difference between a five-minute restore and a bad evening. A backup plugin is one of the few plugins I keep on every site.
The methods at a glance
Pick the row that matches you, then jump to it.
| Method | Ease | Risk | Best for |
|---|---|---|---|
| 1. WPS Hide Login plugin | Easy | Low | Almost everyone |
| 2. A security plugin | Easy | Low | Sites wanting full protection |
| 3. Manual (code) | Hard | High | Developers avoiding plugins |
Method 1
Change it with WPS Hide Login (the easy way)
Best for: Almost every site. One free, maintained plugin, no core files touched.
This is what I reach for first. WPS Hide Login is a free, lightweight plugin with over 2 million active installations and a 4.8-star rating, tested up to the current WordPress release. It does not rename any core files, it just intercepts the request, so a WordPress update will not break it.
How to set it up
- Go to Plugins → Add New, search for WPS Hide Login, then install and activate it.
- Open Settings → General and scroll to the bottom. The plugin adds its fields right there.
- In Login url, enter a custom slug. Make it unique, not
loginoradmin. - In Redirection url, set where bots go when they hit the old
/wp-admin. Sending them to404is fine. - Click Save Changes. Your login now lives at
yoursite.com/your-slug.
Pick a slug bots won't guess
Skip the obvious ones. /login, /admin, and /dashboard are the first things bots try after the defaults. A short random string like /secure-login-9f3 is far harder to stumble onto. Write it down somewhere safe.
The catch: bookmark the new URL before you log out. If you forget it, you are not locked out for good (see common problems below), but it is an avoidable scramble.
Get WPS Hide Login →Method 2
Change it with an all-in-one security plugin
Best for: Sites that want the URL change plus brute-force protection and 2FA in one place.
If you would rather not run a single-purpose plugin, a full security plugin changes the login URL and covers the layers obscurity does not.
One plugin doing the work of three.
Three maintained options I would trust. Each lets you set a custom login slug and adds real protection on top.
Kadence Security (formerly iThemes / Solid Security)
Adds two-factor login, brute-force protection, and file-change detection. The free tier alone covers most sites.
All-In-One Security (AIOS)
A full free suite: a firewall, login lockdown, user-enumeration blocking, and a login-page URL change.
WP Ghost (Hide My WP Ghost)
Goes furthest on obscurity, hiding wp-admin, wp-content, wp-includes and other default paths, with firewall protection on top.
For a site that takes security seriously, this is the tidier route: one plugin doing the URL change and the brute-force defence together. The trade-off is weight. A full suite does more than WPS Hide Login, so if all you want is the URL change, the single-purpose plugin stays the lighter pick.
Method 3
Change it manually with code
Best for: Developers who refuse plugins and are comfortable with FTP and core files.
You can change the login URL without a plugin, but I only suggest this if you are comfortable with FTP or your host's file manager, and you have a backup ready.
The honest warning first: editing core files is the fragile way to do this. Editing or renaming core WordPress files gets overwritten on every WordPress update. You will have to reapply the change each time, and a mistake here can lock you out. The plugin methods avoid both problems.
Option A: rewrite in .htaccess (Apache only)
Connect by FTP, open the .htaccess file in your WordPress root, and add a rule that maps a secret slug to the login and redirects the old path away:
RewriteRule ^my-custom-login$ /wp-login.php?secret_key=YOUR_SECRET_KEY [NC,L]
RewriteRule ^(.*)wp-login\.php(.*)$ / [L,R=302]Replace my-custom-login with your slug and YOUR_SECRET_KEY with a random string. This works on Apache and LiteSpeed, not Nginx.
Option B: rename wp-login.php
Download wp-login.php as a backup, open it, find-and-replace every instance of wp-login with your custom slug, save it as your-slug.php, and upload it back. Your login becomes yoursite.com/your-slug.php.
Both options do the job, and both get wiped by the next core update. That is the price of skipping the plugin.
Changing the URL is not enough: pair it with real security
Hiding the login stops the bots, but security through obscurity does not harden the door behind it.
Site security is an engineering problem, not a single setting. So layer these on top.
- Use strong, unique passwords and a manager. Most break-ins are weak passwords, not clever exploits.
- Turn on two-factor authentication. Kadence Security and most security plugins add it free. It is the single biggest upgrade after the URL change.
- Limit login attempts. A plugin like Limit Login Attempts Reloaded locks out an IP after a few failures, which kills brute-forcing outright.
- Drop the
adminusername. If your admin account is literallyadmin, the bots already have half your credentials. Create a new admin user and delete it.
Do those four and the hidden URL becomes the lightest layer in a real defence, not a lonely trick.
Common problems and fixes
A few things trip people up. None are serious if you keep a backup.
- You forgot the custom URL and can't log in. Connect by FTP, go to
wp-content/plugins, and rename thewps-hide-loginfolder (for example towps-hide-login-off). That deactivates it and restores the default/wp-admin. Log in, then set the slug again and write it down. - The new URL shows a 404. Go to Settings → Permalinks and click Save once to flush the rewrite rules. That fixes most 404s after the change.
- A caching or security plugin conflicts. If the login behaves oddly, clear your cache and check no second plugin is also rewriting the login path. Two plugins fighting over
/wp-login.phpis a common cause.
Final take
Changing your WordPress login URL is a five-minute job that removes you from the easiest, noisiest class of attack. For almost everyone, WPS Hide Login is the right tool: free, maintained, and nothing to break on update.
Just remember what it is. It hides the door, it does not bolt it.
Pair it with strong passwords, two-factor login, and a brute-force limit, and you have a genuinely harder target.
If hardening or speeding up a WordPress site is more than you want to take on yourself, that is the kind of work we do.
Want your WordPress site properly hardened?
Send us the site. We handle the login lockdown, brute-force protection, two-factor setup, and the speed work, so it is secure without slowing down. The first reply comes from Sunny, not a sales team.
See WordPress developmentCommon questions
What is the default WordPress login URL?
Every WordPress site uses the same two by default: yoursite.com/wp-admin and yoursite.com/wp-login.php. Both lead to the same login form. Because they are identical on every site, bots target them automatically, which is exactly why changing them helps.
Is it safe to change the WordPress login URL?
Yes, if you use a maintained plugin like WPS Hide Login. It does not rename core files, so a WordPress update will not break it. The manual method is riskier, because editing wp-login.php or .htaccess can lock you out if you make a mistake.
What happens if I forget my custom login URL?
You can get back in. Connect to your site by FTP or your host file manager and deactivate the plugin by renaming its folder in wp-content/plugins. That restores the default /wp-admin so you can log in, then set the slug again.
Does changing the login URL actually stop hackers?
It stops automated bots, which are the bulk of login attacks, by sending them to a 404. It does not stop a determined attacker targeting you specifically. That is why it is one layer, paired with strong passwords, two-factor login, and brute-force limits.
Can I change the WordPress login URL without a plugin?
Yes, by adding rewrite rules to .htaccess on Apache, or by renaming wp-login.php. Both work, but core-file edits get overwritten on every WordPress update, so you have to reapply them. For most sites the plugin method is safer and far less hassle.
Will changing my login URL slow down my site?
No. WPS Hide Login is lightweight and just intercepts requests to the login page, so it adds no real overhead. If anything, blocking bot traffic to /wp-admin reduces wasted server load from constant brute-force attempts.
SEO Specialist and product builder with 10+ years in search. The notes come from the work, not the theory.