Changing the WordPress Login URL: Brute-Force Protection in 5 Minutes

/wp-admin and /wp-login.php are the two most attacked URLs on any WordPress site. Bot networks permanently work through username and password combinations there. On an unprotected site, a few thousand brute-force attempts per day are normal — and very rarely harmless. The simplest and most effective first line of defence is to move the login URL. In this article I show you how to do that without server configuration and without the risk of locking yourself out.

Why change the login URL at all?

Three effects:

1. Brute-force attempts come to nothing. Bots keep trying /wp-login.php — they do not know your real login URL.
2. Server load drops. Every brute-force attempt consumes PHP and database resources. Measurable on shared hosting.
3. The security log gets cleaner. You see actual attacks instead of 99 % bot noise.

This is not complete protection — a professional attacker will find the new URL via scanners or fingerprints (login form structures). But it eliminates 95 % of the automated pressure.

Method 1 (recommended): the "WPS Hide Login" plugin

The plugin does exactly one job, does it cleanly and needs no server permissions. Over 1 million active installations, continuously maintained.

Here is how to proceed:

1. Plugins → Add New → search for "WPS Hide Login" → install, activate.
2. Under Settings → WPS Hide Login, enter the new login slug, for example my-access or northstar-42. Avoid words such as "admin", "login" or "secret" that appear in scanner word lists.
3. Set the redirect URL — where visitors who are not logged in are sent when they call /wp-admin. Default: the 404 page. I recommend the homepage or a custom page instead.
4. Save.

Important — before you save: note the new slug somewhere safe, ideally in your password manager. If you forget it, you will have to deactivate the plugin via FTP (see the emergency section below).

Immediately after saving, test:

• https://your-domain.at/wp-admin → should lead to the redirect target.
• https://your-domain.at/wp-login.php → likewise.
• https://your-domain.at/my-access → the login form appears.

If everything fits: update your password manager bookmarks straight away.

Method 2: as a built-in feature of your security plugin

If you already run Solid Security (formerly iThemes Security) or Wordfence, you do not need an additional plugin. Both offer "hide backend" / "hide login URL" as an integrated feature.

Advantage: one plugin fewer. Disadvantage: when switching plugins you have to make sure the new login URL is preserved or deliberately changed.

With Solid Security: Solid → Settings → Hide Backend → enable → set URL → save.

More on the security plugin comparison in my pillar article WordPress plugins 2026 and in the existing WordPress security measures.

Method 3: server-side via .htaccess (Apache)

For experienced users on Apache hosting. The login URL is moved without a plugin:

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^my-access/?$ /wp-login.php [L]
    RewriteCond %{REQUEST_URI} ^/wp-login.php [NC]
    RewriteCond %{HTTP_REFERER} !my-access [NC]
    RewriteRule ^.*$ - [F,L]
</IfModule>

Advantages: no plugin load, and it takes effect very early in request processing. Disadvantages: when another tool rewrites the .htaccess during a theme or plugin update, the rule is often overwritten. Higher maintenance effort.

With Nginx (instead of Apache) this does not work — there you would need to change the Nginx config, which most hosts do not allow. The plugin solution is then the pragmatic route.

The login URL alone is not enough — three additions

While you are in security mode, add these three things:

1. Two-factor authentication (2FA)

The single most important security measure. Even with a correct password, 2FA protects access.

Recommended plugins:

• WP 2FA (free)
• Two-Factor (open source, by WordPress core developers)
• Solid Security Pro (built in)

You scan a QR code with an authenticator app (Google Authenticator, Authy, 1Password, Bitwarden), and at login you enter a six-digit code after your password.

2. Remove the default username "admin"

If your admin user is still called "admin", the first half of the brute-force attempt has already been guessed. Create a new admin user with a different name, remove the rights of the old "admin" user, log in with the new user, delete the old one. When deleting, the old user's content is reassigned to another user — no data is lost.

3. Limit login attempts

Even with a moved URL — if the new URL is eventually found after all, the attacker should be locked out for an hour after five failed attempts.

Plugins: Limit Login Attempts Reloaded (free); Solid Security and Wordfence have it built in.

Do you want to learn WordPress security as a coherent system rather than in fragments? In my online course I show you the security layer stack I set up on every new site — from login through to firewall. → To the online course

Emergency: locked out because you forgot the URL

It happens. Above all after a hosting migration, or when the plugin temporarily resets the URL after an update. This is how you get back in:

1. Go via FTP/SFTP to the directory wp-content/plugins/wps-hide-login/.
2. Rename the folder to wps-hide-login-disabled.
3. WordPress automatically deactivates the plugin as a result.
4. /wp-login.php is reachable again at the standard path.
5. Log in, set a new URL value or reconfigure the plugin.

If you have no FTP access: open the same path via your hosting file manager (cPanel, Plesk, ISPConfig and so on).

Edge case: WooCommerce accounts

WooCommerce customers do not log in via /wp-login.php but via /my-account. The WPS Hide Login plugin leaves that route alone — WooCommerce login continues to work normally. Important: test this explicitly once before you activate the plugin.

Edge case: membership plugins (Paid Memberships Pro, Restrict Content Pro)

These plugins often create their own login forms. As with WooCommerce, the custom login routes are not affected. You are only moving access to the admin back end.

SEO effect: positive

A moved login URL has no direct SEO effect — but indirectly:

• Server load drops → better TTFB → better Core Web Vitals (see WordPress Page Speed 2026).
• Fewer successful hacks → no blocking in Google Safe Browsing, no loss of reputation.

More SEO background in WordPress SEO fundamentals.

Frequently asked questions

Does this work with multisite?
Yes, WPS Hide Login explicitly supports multisite. A different URL can be set per subsite.

Can I change the URL again later?
At any time. Enter the new value in the plugin settings and save. The old URL is dead immediately.

What happens to clicks on old bookmarks?
They land on the redirect target URL (homepage or 404, depending on your setting).

Do scanners find the new URL anyway?
Professional scanners do, given enough time. Standard bots: mostly no. Moving the login URL is defence in depth, not a silver bullet.

Should I also change the default database prefix wp_?
On new installations: yes, it does no harm. On existing installations: the effort rarely justifies the benefit — the risk of wrecking the database is real.

Does this work with the REST API and application passwords?
Yes. REST API requests go through /wp-json/, not the login URL — unaffected.

Conclusion

Installed in five minutes, it switches off 95 % of automated brute-force pressure. Combined with 2FA, a changed username and a login limit, you have a WordPress site that is simply too expensive for the vast majority of attackers.

If you want to learn WordPress security as a coherent concept — not as ten loose tips — my online course is the direct route. → To the online course

---

Image source, featured & inline: illustrations created specifically in the pletzenauer design (no stock photos).