Why Change the WordPress Login URL?

Changing the default login URL (wp-login.php or wp-admin) helps to:

• Prevent Brute Force Attacks: It obscures the path to the login page, making it harder for automated attacks to find it.
• Reduce Unauthorized Access: It adds an extra layer of obscurity that can deter casual hackers.
• Decrease Server Load: It minimizes the impact of bots constantly hitting the default login page.

Step 1: Back Up Your Site

Always start with a full backup of your WordPress site. This safety step ensures you can revert to the original state if any issues arise during the update.

Step 2: Use a Reliable Security Plugin

To change the login URL easily, use a security plugin like WPS Hide Login, iThemes Security, or All In One WP Security & Firewall. Here, we’ll focus on using WPS Hide Login.

Step 3: Configure WPS Hide Login

1. Install the Plugin: Go to Plugins > Add New in your WordPress dashboard, search for “WPS Hide Login,” and install it.
2. Set Your New Login URL: Navigate to Settings > WPS Hide Login and input your preferred custom login URL.
3. Save Changes: Don’t forget to bookmark or remember the new URL!

Step 4: Test the New URL

Verify that the new login URL works and that the default URLs redirect to a 404 page, ensuring no unauthorized access to the standard paths.

Step 5: Opt for Managed WordPress Hosting by UnderHost

UnderHost.com offers managed WordPress hosting designed to maximize security and performance. Our services include automatic updates, daily backups, advanced caching, and enhanced security measures tailored for WordPress sites. By choosing UnderHost, you ensure your website benefits from the best practices in security and management.

Conclusion

Changing the login URL is a straightforward yet effective security enhancement. Pair this approach with comprehensive managed hosting services from UnderHost.com to ensure your WordPress site remains secure, fast, and reliable.

Before you change the login address

1. Take a full backup of the site.
2. Write down the new login address somewhere safe. A forgotten address can lock you out.
3. Test the change on a staging copy first, if you have one.
4. Check that plugins which send login links or use the admin AJAX endpoint still work.

Why a hidden login address is only one layer

Moving the login page reduces automated attempts, but it does not protect a site with a weak password or outdated software. Treat it as one layer alongside the protections below.

• ✓ Use a strong, unique password for every admin user.
• ✓ Turn on two-factor authentication for administrators.
• ✓ Limit login attempts with a security plugin or a server firewall.
• ✓ Keep WordPress, themes and plugins updated.
• ✓ Remove admin users you no longer need.

If you get locked out

If you lose the new address, rename the plugin folder that changes the login page, using cPanel’s File Manager, and log in at the default address. Then rename the folder back and set the address again. WP-CLI can also reset a password, as described in our password reset guide.

Choosing a security plugin

Pick a plugin that is actively maintained, has recent updates, and is used by many sites. Check the plugin’s last update date and its support forum before you install it. Use one security plugin, not several, so their rules do not conflict.

• Limit failed login attempts and block repeated offenders.
• Require two-factor authentication for administrators.
• Scan files for changes and known malware.
• Log login activity so you can review it.

Test the site after the change

• Log in and out from a private window, using the new address.
• Check that the old address now shows the expected 404 page, not a working login.
• Test password reset emails, forms and any plugin that uses the admin area.
• Clear the caching plugin, then recheck the login page.