Here’s How to Change WordPress Login URL Without Locking Yourself Out!

The decision to change WordPress login URL sounds simple until the new address is missing and your dashboard is out of reach. Most people are motivated by seeing login attempts in their logs or trying to make /wp-admin/ less obvious.

While these are fair reasons, the critical mistake is treating a hidden URL as a complete login security solution.

This guide shows the safest way to change the login URL, how to test it before you log out, what to do if you forget the new address, and when the no-plugin route is more trouble than it’s worth.

TL;DR: Use a maintained plugin like WPS Hide Login, set a private login slug, save the new URL, and test it in a private browser window before ending your current session.Changing the login URL can reduce basic bot noise, but it still needs 2FA, login limits, strong passwords, updates, backups, and a good firewall around it.

What WordPress Uses By Default?

Most WordPress sites use /wp-login.php for sign-in. Visit /wp-admin/ while logged out, and WordPress usually moves you to that screen.

If WordPress lives in a subdirectory or subdomain, the same rule follows that location. A site installed under /blog/ will usually log in at /blog/wp-login.php. A subdomain install may use blog.example.com/wp-login.php.

WordPress does not give you a normal dashboard setting to change this. That’s why people use a plugin, server rule, or manual file change.

Before You Touch The Login URL

Do these checks first. They take a few minutes and prevent most self-made lockouts.

⚠️ Note: If you run WooCommerce or any site with public accounts, try the change on a staging copy first. That includes membership sites, LMS sites, and client portals. Public account login and private admin login are not always the same flow, and you don’t want a security tweak to break checkout or password resets.

Use A Plugin For Most Sites

For most WordPress sites, I would use a plugin before editing WordPress files by hand. WPS Hide Login is a good example because it does one narrow job: it lets you set a new login slug and decide what happens when someone visits the old login paths. That narrowness is useful here. You want one setting to check if something goes wrong.

In our test on WordPress 6.9.4, WPS Hide Login 1.9.18 loaded the normal WordPress login form at the custom slug. The old logged-out login paths no longer behaved like standard login routes.

That doesn’t mean the plugin renames the WordPress admin folder. It changes how login requests are handled. Logged-in admins still use the dashboard as usual.

Install And Activate The Plugin

Open Plugins > Add New in the dashboard. Search for WPS Hide Login, install it, and activate it.

Stay logged in while you make the change. This gives you a live session to fix settings if the first attempt is wrong. If your current security plugin already has a login-hiding setting, use that instead of adding a second tool for the same job. Two plugins fighting over one login route can make troubleshooting painful.

Set A New Login Slug

Go to Settings > General and find the WPS Hide Login settings. In Login URL, enter only the new slug unless the plugin asks for the full URL. For example, if you enter staff-entry-27, your new login page becomes example.com/staff-entry-27.

Use lowercase letters, numbers, and hyphens. They’re easier to type, easier to share privately, and less likely to break because of a copied character.

Send Old Login Requests To A Dead End

In Redirection URL, choose where visitors should land if they try the old paths. For a private admin login, 404 is usually the cleanest choice.

Don’t redirect /wp-admin/ straight to your new login URL. That gives away the new address to anyone who checks.

Save The URL Somewhere Private

Put the new login URL in your password manager, team documentation, or client handoff notes. A bookmark helps, but don’t make it the only record.

🔐 Note: Treat the new URL like an internal admin detail. Don’t place it in a public help page, footer link, chatbot response, or onboarding document that anyone can access.

Test Before You Log Out

Open a private or incognito browser window and visit the new login URL. Log in from that private window if possible. Then test the old paths: /wp-login.php and /wp-admin/. A logged-out visitor should no longer see the normal login form there.

Also test logout and password reset. A login change is only finished when sign-in, sign-out, and reset links all behave properly.

Tell The People Who Need It

Send the new URL only to people who actually need dashboard access. Use a private channel, and make sure to restrict admin access so only essential team members can log in.

If your host has a one-click WordPress login shortcut, test it. If it stops working, that’s fine as long as your team knows the real login URL.

If The New Login URL Fails

Don’t guess random slugs in the browser. Use the recovery path.

First, check your password manager and bookmarks. Then check team notes or client handoff docs. If the URL is truly missing or broken, open your hosting file manager, FTP, or SSH access and go to wp-content/plugins/.

Find the login-hiding plugin folder. For WPS Hide Login, the folder is usually wps-hide-login. Rename it to something like wps-hide-login-disabled.

WordPress will stop loading the plugin from that folder, so /wp-login.php usually starts working again. Log in, fix the setting, then rename the folder back or remove the plugin.

🧯 Note: Clear cache before blaming the plugin. A cached login page can cause login loops, failed password resets, or a form that reloads after you submit it.

Changing The Login URL Without A Plugin

You can change the WordPress login URL without a plugin, but I don’t recommend it for most site owners. There are two common manual routes.

Use the manual route only if you’re comfortable with all of this:

I wouldn’t delete or edit WordPress core files on a live site for this. Core files are the files WordPress itself relies on, and updates expect them to stay predictable.

Cache And CDN Checks

Your custom login URL needs different cache rules from public pages.

If login starts acting strange after the change, exclude the new login URL from every cache layer you use. Check your cache plugin first, then your host, then Cloudflare or any other CDN. A CDN is a service that serves saved copies of pages from servers closer to visitors, which is useful for public pages but risky for login screens.

Common caching issues include login loops, password reset failures, cookies that don’t stick, and forms that reload without signing you in.

What This Change Actually Protects

Changing the login URL is useful when bots are blindly attacking default WordPress paths. It can reduce junk traffic, quiet down logs, and make basic automated attempts less convenient.

It won’t stop someone who already knows the new URL. It won’t fix weak or reused passwords. It also won’t protect vulnerable plugins, malware-infected files, XML-RPC attacks, or REST API attacks. XML-RPC and REST API are WordPress connection methods that tools can use without visiting the normal login page.

The real WordPress security stack is less exciting and far more important:

MalCare fits after this point, once the login URL job is done. A hidden login URL can reduce default-path bot traffic, but broader WordPress security needs a WordPress firewall, brute-force protection, malware scanning, vulnerability monitoring, and a cleanup path if something gets through.

Should You Change wp-admin?

Usually, no. Change the login route and leave the wp-admin folder alone.

The wp-admin folder is the WordPress dashboard area. Most login-hiding plugins leave it alone. When a logged-out person visits /wp-admin/, the plugin can block or redirect that request. When a logged-in admin visits the dashboard, WordPress still works normally.

When someone says “change wp-admin URL,” the safer version is this: change where logged-out users sign in and leave the WordPress admin directory alone.

What I Would Do

For a normal business site, I’d use WPS Hide Login or the login-hiding feature in an existing security plugin. I’d set a private slug and send old login requests to 404. Then I’d save the new URL, exclude it from cache, and test the full path: login, logout, password reset, /wp-login.php, and /wp-admin/.

For a WooCommerce or membership site, I’d try the change on a staging copy before touching production. I’d do the same for LMS and portal sites because their public login flows can be easy to miss.

For a site under active attack, I’d change the URL only as a quick noise reducer. Then I’d review admin users and force password resets where needed. After that, I’d enable 2FA and limit login attempts. I’d also scan for malware, update vulnerable software, and put a firewall in front of the site.

FAQs

Can I change the WordPress login URL?

Yes. Most sites should use a maintained plugin. Manual methods are possible, but they need more testing and a clear rollback plan.

What is the default WordPress login URL?

The default login URL is usually /wp-login.php. If you visit /wp-admin/ while logged out, WordPress normally moves you to the login screen.

Does changing the login URL stop brute-force attacks?

It can reduce basic attempts against default login paths. It still needs 2FA, login limits, strong passwords, current software, restorable backups, and a firewall.

What should my new login URL be?

Use something private but manageable. Avoid login, admin, and wp-admin. Also skip your brand name, domain name, and anything you publish publicly.

What if I forget the custom login URL?

Rename the login-hiding plugin folder from your hosting control panel. FTP or SSH access works too. That usually restores the default login URL so you can get back into WordPress.

Conclusion

Changing the WordPress login URL is worth doing when you keep it in its proper place. Use a plugin and choose a private slug. Save it somewhere your team can find. Test before logging out, and make sure cache rules don’t touch the new login page.

After that, do the security work that matters more. Add 2FA, limit login attempts, keep software updated, and monitor vulnerabilities. Use a firewall and keep restorable backups. A hidden login URL can lower the noise, but it should never carry the whole job of protecting your WordPress site.