{"id":38314,"date":"2024-10-07T00:01:00","date_gmt":"2024-10-07T07:01:00","guid":{"rendered":"https:\/\/dhblog.dream.press\/blog\/?p=38314"},"modified":"2025-05-21T22:13:23","modified_gmt":"2025-05-22T05:13:23","slug":"change-wordpress-login-url","status":"publish","type":"post","link":"https:\/\/www-dev.dreamhost.com\/blog\/change-wordpress-login-url\/","title":{"rendered":"How To Find Your WordPress Login URL & Upgrade It for Security"},"content":{"rendered":"\n

Strong, unique passwords can help prevent unauthorized access to your small business\u2019s WordPress website<\/a>.<\/p>\n\n\n\n

However, attackers have several<\/em> clever ways of getting around them.<\/p>\n\n\n\n

Just like relentless youngsters who seem to outsmart every childproofing tactic you throw their way, malicious actors know how to carry out brute-force attacks and find backdoors through less secure plugins.<\/p>\n\n\n\n\n\n

\n\t\n\t\t<\/svg>\n\t\t<\/span>\n\t\t<\/svg>\n\t<\/a>\n

Brute-Force Attack<\/h3>\n

A brute-force attack is a cyber assault where an attacker uses trial and error to break into an account. Malicious bots attempt to guess passwords, login credentials, or digital keys repeatedly.<\/p>\n \n Read More <\/a>\n\n<\/div>\n\n\n\n

And, voila, they\u2019re inside your site stealing data faster than a toddler can pull out and empty every drawer in your kitchen (AKA, remarkably<\/em> fast).<\/p>\n\n\n\n

In other words, passwords often aren\u2019t enough to properly protect your site against attacks.<\/p>\n\n\n\n

Fortunately, there\u2019s a relatively simple thing you can do to reduce the risk of hackers getting into your site \u2014 moving your WordPress login page to a new URL. This will put you in a better position to defend against hacks and attacks.<\/p>\n\n\n\n

If you’re not too familiar with WordPress, this probably won’t make much sense. That\u2019s why this article will take a closer look at why you should consider changing your WordPress login URL, how to find your login URL if you’ve lost track of it, and, most importantly \u2014 a few ways to modify it to boost security.<\/p>\n\n\n\n

And if you stay tuned all the way to the end, we\u2019re also including a list of additional tips for further strengthening your WordPress security.<\/p>\n\n\n\n

Let\u2019s get secured!<\/p>\n\n\n\n

Why You Should Update a Default WordPress Login URL<\/h2>\n\n\n\n

Since WordPress doesn\u2019t hide your login page, any user can find it as long as they know how WordPress structures its URLs. Considering WordPress powers close to half of all websites<\/a> on the internet, it\u2019s safe to assume a lot of folks \u2014 especially those who know how to exploit websites \u2014 are very familiar with the common WordPress layout.<\/p>\n\n\n\n

The default structure for a login page usually looks something like this:<\/p>\n\n\n\n

https:\/\/example.com\/wp-login.php<\/strong><\/p>\n\n\n\n

This means when a user plugs your website URL into where it says \u201chttps:\/\/example.com\/,\u201d they should see a page in their browser prompting them to log in to the back end of your website:<\/p>\n\n\n\n

\"Screenshot<\/figure>\n\n\n\n

Of course, most hackers probably won\u2019t have the login credentials they need. However, this structure is still risky if your password is common, weak, or easy to guess. Something like 123456<\/a>.<\/p>\n\n\n\n

Simply put, it’s an easy fix for an unnecessary vulnerability.<\/p>\n\n\n\n

For simplicity\u2019s sake, many people prefer to stick with this default wp-login<\/strong> structure for signing into WordPress, but leaving it as it is makes it easy for hackers to access your login area, which is like doing half of their job for<\/em> them.<\/p>\n\n\n\n

WPScan found that WordPress currently has more than 50,000 vulnerabilities<\/a> in 2024. The vast majority are found in WordPress plugins, and hundreds, if not thousands more are discovered every year.<\/p>\n\n\n\n

\"Vulnerabilities<\/figure>\n\n\n\n

In short, it’s time to toughen up your website’s security.<\/p>\n\n\n\n

An achievable way to do so is to change your WordPress login URL to prevent unauthorized access to your site and reduce the risk of brute-force attacks.<\/p>\n\n\n\n

Here\u2019s How To Find the Default WordPress Login Page<\/h2>\n\n\n\n

Look, we know you have a lot going on. When you’ve got a million things on your plate as a small business owner, losing track of your WordPress login URL isn’t uncommon.<\/p>\n\n\n\n

As we mentioned in the previous section, WordPress uses a standard sign-in link structure that looks something like this:<\/p>\n\n\n\n

https:\/\/example.com\/wp-login.php<\/strong><\/p>\n\n\n\n

So, all you have to do is add the suffix (this part: wp-login.php<\/strong>) to your domain, and you should land on your login page.<\/p>\n\n\n\n

You can also find your login page by trying to access your WordPress dashboard while logged out<\/a>. Simply enter \u201cyourwebsite.com\/admin\u201d or \u201cyourwebsite.com\/login\u201d into the search bar and you should land on the same login page.<\/p>\n\n\n\n

Not working? Don\u2019t panic.<\/p>\n\n\n\n

Some web hosts change your WordPress login page automatically for security reasons. So you might already have<\/em> a custom login URL. If so, we\u2019ll show you how to find it right now.<\/p>\n\n\n\n

Custom Login URL? Here\u2019s How To Locate It<\/h2>\n\n\n\n

If your web host has changed your login link, you can usually locate it within your control panel after logging into your hosting account.<\/p>\n\n\n\n

However, if you can\u2019t identify your custom login URL there, you can still locate it manually by connecting to your site using an SFTP<\/a> client like FileZilla.<\/p>\n\n\n\n\n\n

\n\t\n\t\t<\/svg>\n\t\t<\/span>\n\t\t<\/svg>\n\t<\/a>\n

SFTP<\/h3>\n

SFTP (Secure File Transfer Protocol) is a safer way to transfer files online. Unlike FTP, SFTP uses encryption to protect your data while it’s being sent, keeping it secure from unauthorized access.<\/p>\n \n Read More <\/a>\n\n<\/div>\n\n\n\n

You may be able to find the credentials to do so in your hosting account or ask your website host for the details.<\/p>\n\n\n\n

After installing the client and connecting using those credentials, you should land on a page that looks something like this:<\/p>\n\n\n\n

\"FileZilla<\/figure>\n\n\n\n

Find the root folder labeled public_html<\/strong> (you can see it above on the right side of the screen) and click in to locate the wp-config.php<\/strong> file. If you can\u2019t find it as public_html<\/strong>, it may instead be listed as your domain name.<\/p>\n\n\n\n

Open this file on your computer using a text editor like Visual Studio Code. It\u2019s best to use an option that provides a search and replace tool. Use that tool to find a string of code containing site_url<\/strong> \u2014 this will direct you to your custom login URL.<\/p>\n\n\n\n

Boom, you\u2019ve found it! With that out of the way, let’s update this URL for better security.<\/p>\n\n\n\n

Two Strategies To Change Your WordPress Login URL<\/h2>\n\n\n\n

Now that you know where to find the WordPress login URL, let\u2019s take a look at two easy ways you can change it.<\/p>\n\n\n\n

Method 1: Upgrade Your WordPress Login URL With a Plugin<\/h3>\n\n\n\n

The easiest way to change your login URL is by using a WordPress plugin<\/a>. Luckily, there are plenty of these available to facilitate this.<\/p>\n\n\n\n

WPS Hide Login<\/a> is a great option since it\u2019s lightweight and allows you to safely change your WordPress admin login page to anything you want. Better yet, WPS Hide Login also prevents all logged-out users access to the wp-admin<\/strong> directory and wp-login.php<\/strong>.<\/p>\n\n\n\n

To get started, you\u2019ll need to install and activate the plugin by going to your WordPress admin area. Click on Plugins<\/strong> > Add New Plugin<\/strong>.<\/p>\n\n\n\n

\"Closeup<\/figure>\n\n\n\n

Search for \u201cWPS Hide Login\u201d and hit the Install Now<\/strong> button. Stay on this page until the installation is complete, then use the Activate <\/em><\/strong>button.<\/p>\n\n\n\n

\"Screenshot<\/figure>\n\n\n\n

Once activated, in the sidebar of your WordPress admin, head to Settings<\/strong> > WPS Hide Login<\/strong>.<\/p>\n\n\n\n

\"Screenshot<\/figure>\n\n\n\n

You\u2019ll see that you can create a new login URL. Type in whatever you like and hit Save Changes<\/strong>.<\/p>\n\n\n\n

It\u2019s as simple as that.<\/p>\n\n\n\n

\"screenshot<\/figure>\n\n\n\n

Bear in mind that once this plugin is active and you make your changes, using the new URL will be the only way to access your site\u2019s login screen.<\/p>\n\n\n\n

So don\u2019t lose this URL. And don\u2019t share it publicly or with anyone who doesn\u2019t absolutely need it!<\/p>\n\n\n\n

Also, remember that your site will revert to using wp-admin<\/strong> and wp-login.php<\/strong> if you deactivate this plugin.<\/p>\n\n\n\n

Method 2: Update Your WordPress Login URL by Editing Your wp-login.php File<\/h3>\n\n\n\n

This second method is a little trickier, and most likely best suitable for experienced users. Therefore, before you get started with the following steps, it\u2019s best to make a fresh WordPress backup<\/a> of your site in case anything goes wrong.<\/p>\n\n\n\n

It\u2019s also important to know that your changes may revert to their previous settings when you update your theme. If you want to avoid this issue, learn how to use a WordPress child theme<\/a>.<\/p>\n\n\n\n

Now, let\u2019s dive in.<\/p>\n\n\n\n

You\u2019ll need to access your site\u2019s files, just like we did earlier when tracking down your custom login URL. You\u2019ll be able to do this via your website host admin panel, or SFTP.<\/p>\n\n\n\n

If it\u2019s the latter, use your credentials to connect to your site via your SFTP client of choice, and again, locate the public_html<\/strong> file (again, it might be listed as your domain name instead.) Inside, find the wp-login.php<\/strong> folder. The code behind your site’s login page lives here.<\/p>\n\n\n\n

Open the file using your text editor again.<\/p>\n\n\n\n

Use the search tool to find every instance of wp_login_url<\/strong>, which will look something like this:<\/p>\n\n\n\n

\"Screenshot<\/figure>\n\n\n\n

The strings following the wp_login_url<\/strong> will contain your current login URL. Change each to the new login URL that you\u2019d like to use.<\/p>\n\n\n\n

Remember, you can keep it straightforward so long as it\u2019s original (and different from the default). For example, you might prefer something like \u201caccess.php\u201d or \u201cwp-new-login.\u201d<\/p>\n\n\n\n

Once you\u2019re happy with your changes, save them, and close the editor. Then, rename the file after the new URL that you chose (such as \u201caccess.php\u201d).<\/p>\n\n\n\n

Note: <\/strong>You can technically name the file whatever you\u2019d like, but it\u2019s easier to track and remember if you name it after the new URL you plan to use.<\/p>\n\n\n\n

Drag the file from your desktop into the public_html <\/strong>file.<\/p>\n\n\n\n

Now, you can upload the new file to your root directory using your FTP client or your web host\u2019s file manager. We\u2019ll show you how to do this using the WordPress \u201clogin_url\u201d filter hook<\/a>.<\/p>\n\n\n\n

Start by navigating to wp-content<\/strong> > themes<\/strong>, selecting your active theme, and opening the functions.php<\/strong> file (preferably under a child theme.) This is telling WordPress where the new login file \u201clives.\u201d<\/p>\n\n\n\n

Here, you can paste the following line of code into the file:<\/p>\n\n\n\n

\/*\n*Change WP Login file URL using \u201clogin_url\u201d filter hook\n*https:\/\/developer.wordpress.org\/reference\/hooks\/login_url\/\n*\/\nadd_filter( \u2018login_url\u2019, \u2018custom_login_url\u2019, PHP_INT_MAX );\nfunction custom_login_url( $login_url ) {\n$login_url = site_url( \u2018wp-your-new-login-file-name.php\u2019, \u2018login\u2019 );\nreturn $login_url;\n}<\/code><\/pre>\n\n\n\n
Replace wp-your-new-login-file-name<\/strong> with the name of the file you just created. Then, save your changes and test your new login.<\/p>\n\n\n\n
You’ll need to type in your site’s domain with your new login URL at the end.<\/p>\n\n\n\n
For example: \u201chttps:\/\/example.com\/access.php.\u201d<\/p>\n\n\n\n
If you\u2019re able to access the login page for your WordPress site, it\u2019s worked!<\/p>\n\n\n\n
And now, you can delete the original wp-login.php<\/strong> file, because the new file you\u2019ve added has replaced it.<\/p>\n\n\n\n
Something to remember \u2013 once you\u2019ve updated your login page, you need to update the pages that reference <\/em>the wp-login.php <\/strong>file we just deleted. Specifically, you need to update the logout_url <\/strong>filter<\/a> and the lostpassword_url <\/strong>filter<\/a>.<\/p>\n\n\n\n
\n\n\n
Get Content Delivered Straight to Your Inbox<\/h2>
Subscribe now to receive all the latest updates, delivered directly to your inbox.<\/p>
<\/div>