--- title: "How to Change the WordPress Login URL (and Why It Stops Most Bot Attacks)" url: https://nexterwp.com/blog/change-wordpress-login-url/ date: 2026-07-21 modified: 2026-07-21 author: "Aditya Sharma" description: "Change your WordPress login URL to stop most automated brute force attacks. Two step-by-step methods, the lockout warning to read first, and how to harden after." image: https://nexterwp.com/wp-content/uploads/2026/07/ClKfCOSm-1024x538.jpg word_count: 1775 --- # How to Change the WordPress Login URL (and Why It Stops Most Bot Attacks) ## Key Takeaways - WordPress sites expose /wp-login.php and /wp-admin by default, which automated bots find and hammer even on brand new sites. - Changing the WordPress login URL takes about two minutes and removes most low effort brute force traffic by moving the login page off the default address. - Nexter Extension includes a Custom Login URL feature under Nexter > Extensions > Security, and its Login URL Behaviour dropdown offers Message, Home Page, or 404 Page Template. - WPS Hide Login is a free plugin on version 1.9.18 with 2+ million active installations, a 4.8 out of 5 rating, and it makes wp-admin and wp-login.php inaccessible when active. - Saving the new login URL before changing the setting is critical because there is no recovery link, so FTP or the host's file manager is the fallback if lockout happens. #### Key Takeaways - Every WordPress site puts its login at the same `/wp-login.php` and `/wp-admin` address, which is exactly why automated bots find and hammer it even on brand new sites.- Moving the login page to a custom URL takes about two minutes and removes most low effort brute force traffic, because the bots only knock on the default address.- It is security through obscurity: it hides the door rather than reinforcing it, so treat it as a first layer, not a replacement for real hardening.- Two ways to do it: the built in Custom Login URL in Nexter Extension (paid, bundles other login security) or the free, single purpose WPS Hide Login plugin.- Save the new URL before you save the setting (there is no recovery link), and pair it with limited login attempts, two factor authentication, strong passwords, and updates.   Install a security plugin on a brand new WordPress site, then open its login log a day later. Even with zero traffic and no links pointing anywhere, you will almost always see the same thing: a steady trickle of failed sign in attempts against `admin`, `administrator`, and a handful of common usernames. Nobody found your site because it is popular. They found it because every WordPress install answers at the exact same address, and automated bots simply drive down the list of known WordPress URLs all day. Changing your WordPress login URL is the quiet fix for that noise. It will not make your site bulletproof, and this guide is honest about what it does and does not do. But it is one of the fastest ways to make the automated attacks stop knocking, and it takes about two minutes to set up. Here is how to change it, two ways, plus the one warning you should read before you touch anything. Table of Contents ## What Is the Default WordPress Login URL? By default, every WordPress site puts its login form at `yoursite.com/wp-login.php`. There is a second door too: `yoursite.com/wp-admin`. If you are logged out and try to open `/wp-admin`, WordPress bounces you to `/wp-login.php` and then back to the dashboard once you sign in. Both addresses are identical on every standard WordPress site on the internet, which is exactly the problem. ![WordPress login security settings, where the login URL and related protections are managed](https://nexterwp.com/wp-content/uploads/2025/11/login_security.png)Login security is where brute force noise starts, because the login address is identical on every WordPress site. WordPress has no built in setting to change this. There is no toggle in Settings that renames `wp-login.php`. To move your login page, you either add code to your site or, far more sensibly, use a plugin that handles the rewrite and the redirects for you. We will cover the plugin route because it is safer and reversible. ## Why Change Your Login URL? (And the Honest Limits) Most brute force attacks are not clever. A bot requests `/wp-login.php`, throws a list of common passwords at it, and moves on. Move that login page to `yoursite.com/my-office-door` and the bot hitting `/wp-login.php` gets nothing. The attack surface it was built to find is no longer there. For the volume of low effort automated attempts that hit every site, that alone removes most of the noise. Now the honest part. This is security through obscurity. You are hiding the door, not reinforcing it. A determined attacker who is specifically targeting you can still find the new URL through other means, and a hidden login page does nothing to stop a weak password or an outdated plugin with a known vulnerability. Think of changing the login URL as the first layer, not the whole wall. It is genuinely useful for cutting down automated attacks, but it belongs alongside real hardening, not instead of it. ***Also Read:** [Best WordPress Security Plugins Compared](https://nexterwp.com/blog/best-wordpress-security-plugins/) if you want the firewall and malware scanning layer that a hidden login page does not provide.* ## Before You Change It: The Lockout Warning This is the step most guides bury, so read it first. Once you change your login URL, the old `/wp-login.php` and `/wp-admin` stop working. If you forget the new address, you cannot log in. There is no "forgot my login URL" link. - Write the new URL down somewhere outside your site, such as a password manager, before you save.- Bookmark it in the browser you actually use.- Pick something you can remember but a stranger would not guess. Skip `login`, `admin`, and `dashboard`, since those defeat the purpose. If you do lock yourself out, you are not stuck forever. Connect to your site over FTP or your host's file manager and deactivate the plugin by renaming its folder in `wp-content/plugins`. That restores the default `/wp-login.php` so you can get back in. Knowing that recovery path exists is worth the two minutes it takes to read it. ## Method 1: Change the Login URL With Nexter Extension If you already run Nexter Extension, the Custom Login URL feature is built in, so you do not need to add another standalone plugin just for this. Nexter Extension bundles a set of login security controls together, which keeps your plugin list shorter. ![Nexter Extension Custom Login URL feature for changing the WordPress admin login URL](https://nexterwp.com/wp-content/uploads/2025/11/Change-WP-Admin-Login-URL-for-WordPress.png)The Custom Login URL feature in Nexter Extension changes the WordPress admin login path. Here is the full walkthrough: - In your dashboard, go to **Nexter > Extensions > Security** and find the **Custom Login URL** section.- Turn the feature on, then click the gear icon to open its settings.- In the **Change WP Admin Login Path** field, type the slug you want. For example, entering `secure-login` turns your login page into `yoursite.com/secure-login` instead of `yoursite.com/wp-admin`.- Choose what happens when someone hits the old address using the **Login URL Behaviour** dropdown. You get three options: show a custom **Message**, redirect them to your **Home Page**, or send them to a **404 Page Template**.- Click **Save**. The default `/wp-admin` path goes inactive, and your new custom URL is the only way in. ![Custom Login URL settings in Nexter Extension with the Change WP Admin Login Path field and behaviour dropdown](https://nexterwp.com/wp-content/uploads/2023/02/custom-login-url-settings-new-1.png)Set your custom path and pick what visitors see at the old login address. The 404 behaviour is the quietest choice for security, since a bot hitting the old path gets a plain "not found" with no hint that a login page ever lived there. Nexter Extension is a paid plugin, positioned as "The Power Up Extension for Your WordPress Website" with a 50+ extension library and a 60 day money back guarantee, so the Custom Login URL is one feature among many rather than a single purpose tool. If you want to see the exact controls, the [Custom Login URL documentation](https://nexterwp.com/docs/change-wordpress-admin-login-url-path/) walks through each field. ## Method 2: Change the Login URL With a Free Plugin (WPS Hide Login) If you just want to change the login URL and nothing else, the free WPS Hide Login plugin is the most widely used option. On the WordPress.org plugin directory it lists 2+ million active installations, a 4.8 out of 5 rating, is on version 1.9.18, and is tested up to WordPress 6.9.5, maintained by Remy Perona. It describes itself as "a very light plugin that lets you easily and safely change the url of the login form page to anything you want," and when it is active "the wp-admin directory and wp-login.php page become inaccessible." ![WPS Hide Login plugin listing on the WordPress.org plugin directory](https://nexterwp.com/wp-content/uploads/2026/07/FaTCa8S8hQNjIB25DITlhiPMw_QAJXbf_slHObXfof6WC_5knWWXqbMlekUJi8f5VFG5OC10oP2ZBaFIFpKFaQ-scaled.png)WPS Hide Login is a free, single purpose plugin for changing the WordPress login URL. - Go to **Plugins > Add New**, search for **WPS Hide Login**, then install and activate it.- Open **Settings > General** and scroll to the bottom, where WPS Hide Login adds its options.- In the **Login url** field, enter your new path, for example `secure-login`.- In the **Redirection url** field, set where visitors go if they hit the old `/wp-admin` or `/wp-login.php`. The default is a 404.- Save your changes, and confirm you can reach the new URL in a fresh browser tab before you log out. The trade off between the two methods is simple. If you only ever wanted this one thing, WPS Hide Login is free and does the job. If you also want to limit login attempts, add two factor authentication, and manage other hardening from one place, doing it inside Nexter Extension means fewer separate plugins to keep updated. ***Also Read:** [How to Log Into Your WordPress Website](https://nexterwp.com/blog/how-to-log-into-your-wordpress-website/) for a full tour of the login page and how to find your login URL in the first place.* ## What to Do After You Change It (Do Not Stop Here) Hiding the login page cuts the automated noise, but the controls below are what actually stop an attacker who reaches your login form. Treat the custom URL as step one of a short checklist. ![Enabling Limit Login Attempts in WordPress to block repeated failed sign in tries](https://nexterwp.com/wp-content/uploads/2025/08/enable-limit-login-attempts-new.png)Limiting login attempts stops repeated password guessing even if the login page is found. - **Limit login attempts.** Lock out an IP after a few failed tries so password guessing stalls fast.- **Turn on two factor authentication.** Even a correct password is not enough without the second code.- **Use strong, unique passwords** for every admin account, stored in a password manager.- **Keep WordPress core, themes, and plugins updated,** since most real break ins exploit known, already patched vulnerabilities. Do those four things together with a custom login URL and you have moved from "one of millions of identical targets" to a site that is genuinely tedious to attack. That combination, not any single trick, is what keeps a WordPress site safe. ## Suggested Reading - [How to Log Into Your WordPress Website Securely](https://nexterwp.com/blog/how-to-log-into-your-wordpress-website/)- [How to Add Two-Factor Authentication (2FA) to WordPress](https://nexterwp.com/blog/how-to-add-two-factor-authentication-in-wordpress/)- [Best WordPress Security Plugins: 6 Compared](https://nexterwp.com/blog/best-wordpress-security-plugins/)- [Ways to Protect Content in WordPress](https://nexterwp.com/blog/ways-to-protect-content-in-wordpress/)- [How to Change the WordPress Login Logo](https://nexterwp.com/blog/change-wordpress-login-logo/) ## Frequently Asked Questions ### Does changing the login URL break wp-admin? It changes how you reach it, not whether it works. After you set a custom URL, the old `/wp-admin` and `/wp-login.php` stop serving the login form and instead show a message, your home page, or a 404, depending on the behaviour you chose. Your new custom URL becomes the working way into the dashboard. ### Can I change the WordPress login URL without a plugin? You can, but it means adding custom code and handling the redirects yourself, which is easy to get wrong and hard to undo if you lock yourself out. For almost everyone, a plugin that manages the rewrite safely and can be switched off is the better choice. ### What happens if I forget my new login URL? There is no recovery link, so save it before you save the setting. If you are locked out, connect over FTP or your host's file manager and deactivate the plugin by renaming its folder in `wp-content/plugins`. That brings back the default `/wp-login.php`. ### Does a custom login URL fully stop hackers? No. It hides the login page, which stops most automated brute force attacks that only look at the default address, but it is security through obscurity. Pair it with limited login attempts, two factor authentication, strong passwords, and regular updates for real protection. #### Stay updated with Helpful WordPress Tips, Insider Insights, and Exclusive Updates – Subscribe now to keep up with Everything Happening on WordPress! Subscribe