Changing the WordPress Login URL to Improve Security

Why the default login URL is a security risk

WordPress is used by millions of websites worldwide. By default, the login is reachable at /wp-admin or /wp-login.php. That makes it easy for hackers to run targeted brute-force attacks to guess passwords.

Some security problems caused by the default login URL:

• Brute-force attacks: bots try out usernames and passwords en masse.
• Spam registrations: if you have open registration, bots can create spam accounts.
• DoS attacks on the login page: the login page can be overloaded by a large number of requests.

A simple and effective measure is changing the login URL. This keeps attackers from finding the login page easily.

Method 1: Change the login URL with code (without a plugin)

The most secure method is to adjust the login URL directly in code.

1. Create a new file for the login form

1. Go to your theme directory under wp-content/themes/dein-theme/.
2. Create a new file, e.g. login-meineseite.php.
3. Add the following code:

<?php
/**
 * Eigenes WordPress-Login-Formular
 */
require_once(dirname(__FILE__) . '/wp-login.php');

Now you can log in at deine-seite.de/login-meineseite.php.

2. Disable the default login

Now we need to prevent /wp-login.php from remaining accessible. To do this we add this code to functions.php:

function redirect_default_login() {
    if (strpos($_SERVER['REQUEST_URI'], 'wp-login.php') !== false) {
        wp_redirect(home_url('/login-meineseite.php'));
        exit;
    }
}
add_action('init', 'redirect_default_login');

This code redirects all requests from /wp-login.php to the new login URL.

3. Additionally protect the admin area

If attackers call /wp-admin/ directly, they can bypass the redirect. That is why we also block /wp-admin/ for users who are not logged in:

function protect_admin_area() {
    if (!is_user_logged_in() && !strpos($_SERVER['REQUEST_URI'], 'login-meineseite.php')) {
        wp_redirect(home_url());
        exit;
    }
}
add_action('init', 'protect_admin_area');

As a result, every attempt to access /wp-admin/ is redirected to the home page unless the user is logged in.

Method 2: Change the login URL with a plugin

If you don’t want to make code changes, you can use a plugin. Recommended plugins are:

• WPS Hide Login – changes the login URL without code
• Solid Security – advanced protection for login and admin area

How WPS Hide Login works:

1. Install the plugin via Plugins > Add New.
2. Go to Settings > WPS Hide Login.
3. Change the login URL, e.g. to /geheimer-login.
4. Save the settings.

From now on the default login page is disabled and you can only log in via the new URL.

Additional security measures for the login page

Changing the login URL is a good first step. But there are further ways to increase security.

1. Limit login attempts

To prevent brute-force attacks, you can limit login attempts to 3 with this code:

function limit_login_attempts($user, $password) {
    $attempts = get_transient('login_attempts');
    
    if ($attempts === false) {
        $attempts = 1;
    } else {
        $attempts++;
    }

    if ($attempts > 3) {
        wp_die('Zu viele Fehlversuche! Versuche es später erneut.');
    }

    set_transient('login_attempts', $attempts, 60 * 10);
}
add_action('wp_authenticate', 'limit_login_attempts', 30, 2);

After three failed attempts, login is blocked for 10 minutes.

2. Enable two-factor authentication

Another way to increase security is two-factor authentication (2FA). Plugins like Google Authenticator or WP 2FA add an extra layer of security.

3. Protect the login with CAPTCHA

To block spam bots, you can use Google reCAPTCHA or a more GDPR-friendly alternative like F12 Spam Protection to keep spam bots away from your site.

Conclusion

Changing the WordPress login URL is a simple but effective way to prevent brute-force attacks and unauthorized access. The most secure variant is to change the login path in code while also protecting /wp-login.php and /wp-admin/.

Additional measures such as limiting login attempts, two-factor authentication or reCAPTCHA increase security further.

If you put these tips into practice, your WordPress site will be significantly more secure and harder for attackers to attack!

We created this blog post with the help of AI.