Automated bots overwhelmingly target the default /wp-login.php path blindly, scanning millions of sites at once with no idea or care which ones they’re hitting. Changing your login URL doesn’t stop a genuinely targeted, determined attacker, that’s not really what this is for, it removes your site from that blind automated sweep, meaningfully cutting the volume of brute-force noise your login page ever sees. Worth doing, worth understanding exactly what it does and doesn’t protect against.
Read this warning before you start
This is the one setting on a typical WordPress security checklist that can genuinely lock you out if misconfigured. Before saving any change, open the new login URL in a private or incognito browser window to confirm it actually works, don’t log out of your current session until you’ve verified it. Know your fallback in advance too, most plugins that offer this feature also offer a way to disable it via a constant in wp-config.php, worth knowing where to find that documentation before you need it in an emergency, not during one.
Method 1: a security plugin (the simplest and safest option)
Most WordPress security plugins include a custom login URL feature, letting you set something like /my-secret-login instead of the default /wp-login.php, with the redirect and the safety checks handled for you. This is the recommended approach for most site owners specifically because a well-built plugin handles the edge cases (making sure you can’t accidentally set it to a URL that’s already in use by an existing page, for instance) that a manual approach can get wrong.
Method 2: a dedicated lightweight plugin
If you’d rather not use a broader security plugin just for this one feature, several WordPress.org plugins exist specifically for renaming the login URL and nothing else, a genuinely reasonable choice if this is the only hardening step you want from a plugin. Search the WordPress.org plugin directory for “custom login URL” and check recent update history and review count before installing, since this is exactly the kind of narrow-purpose plugin where an abandoned, unmaintained version is a real ongoing risk.
Method 3: manual implementation with a code snippet
A manual approach is possible using WordPress’s login_url filter and related hooks, but it requires more care to get right (correctly intercepting the default path so it returns a 404 rather than exposing the real login form, and making sure the change survives a plugin or theme update). Given the real lockout risk covered above, this is genuinely one of those cases where a well-tested plugin is worth the small dependency, rather than a from-scratch implementation most site owners won’t have thoroughly tested against every edge case.
Test thoroughly before considering this done
Beyond the initial private-window check, confirm the old /wp-login.php path now returns a genuine 404 rather than still working alongside the new one, some implementations only add the new URL without actually blocking the old one, which defeats the purpose. Confirm password reset emails, if you trigger one, link to a working URL. And confirm any other login-dependent integration on your site (a membership plugin, a custom login widget) still functions correctly with the changed path.
Understand what this does and doesn’t protect against
This is genuinely a volume reducer, not a complete defense. OWASP’s guidance on automated threats distinguishes between broad, indiscriminate scanning and genuinely targeted attacks specifically because the right defense differs for each, and a sophisticated, targeted attacker can usually still fingerprint that a site runs WordPress and find the real login page through other means, this was never designed to stop a determined human specifically targeting your site. What it reliably does is remove you from the overwhelming majority of blind, automated, indiscriminate login attempts that make up most real-world WordPress attack traffic, worth having for that reason even though it’s not, on its own, a complete answer.
Where this fits into a broader security setup
Hiding the login URL works best alongside actual login protections, not instead of them, limiting login attempts and enabling two-factor authentication both still matter even after this change, since a targeted attacker who does find the real login page is exactly the scenario those two protections are built for. For the complete picture, how to secure a WordPress site covers this alongside everything else that matters more broadly.
