Where does WordPress keep the login URL?
The login form is at yourdomain.com/wp-login.php. Typing /wp-admin usually sends you to that form. If WordPress lives in a folder, keep the folder in the path, such as example.com/blog/wp-login.php. You have the right page when the username and password fields load.
That path is not the address under Settings, then General. WordPress Address and Site Address move the whole site. They do not hide the login form.
Why do bots hit /wp-login.php?
The path is the same on almost every WordPress site, so scripts try usernames and passwords against it all day. On shared hosting those hits land on an IP other sites also use. One noisy login page adds load for you and for the neighbours on that IP.
A private slug makes /wp-login.php and /wp-admin return a 404, so those scripts stop. It does not replace a password, a second factor, or a cap on failed tries. Anyone who learns the new slug can still guess.
Which way should you change it?
Use one plugin that serves the form at your slug and returns a 404 for the old path. Do not add a second plugin that rewrites the same URL. They fight, and a correct password can still end on a 404.
| Method | What it does | When it fails |
|---|---|---|
| One hide-login plugin | Serves the form at your slug and returns a 404 for /wp-login.php. | A second hide-login plugin, or a second factor that still posts to the old path. |
| Rewrite that still loads wp-login.php | Adds a short URL in front of the real file. | The real file stays public, so scripts can still post to it. |
| Renaming wp-login.php | Changes the file name on disk. | A WordPress update puts the original file back, and missed references lock you out. |
A rewrite that only points a pretty path at wp-login.php leaves the real file online. Renaming wp-login.php looks hidden until the next WordPress update restores the original file and any missed reference locks the dashboard. Leave the core file where WordPress expects it.
How do you set the new slug?
Take a backup before you change the login path. A restore copy is the way back if the form disappears. The backup plugin comparison lists tools that store one.
Do this while you are still logged in. Stop when a private window shows the form at the new slug and a 404 at the old one.
- Open Plugins, then Add New. Search for WPS Hide Login. Click Install Now, then Activate. A WPS Hide Login block on Settings, then General, means the plugin is on.
- Open Settings, then General, and scroll to that block. Type a slug you have not used in a menu, a post, or a public page. Do not use login, admin, or wp-admin.
- Save Changes. Stay in this browser. Do not log out yet.
- Open a private window and visit your domain plus the new slug. The login form should load. Sign in there. The dashboard means the slug works.
- In that same private window, open /wp-login.php and then /wp-admin. Both should be a 404, not the form. Bookmark the new address, then close the original tab.
If a security plugin you already run has its own login-URL field, use that field and do not add WPS Hide Login as well. Two change-login modules are a common cause of a 404 immediately after a correct password.
What do you do if the new URL locks you out?
Do not edit the database first. The plugin stores the slug. Turning that plugin off brings /wp-login.php back.
In the hosting file manager, or over FTP, open wp-content/plugins and rename the hide-login plugin folder. Add -off to the folder name. Reload /wp-login.php. The form should load. Log in, rename the folder back, and set the slug again. Change one plugin at a time.
A 404 after the password, while the old URL is already hidden, often means a second factor still posts to the old path. Turn that second factor off, confirm the new slug logs you in, then turn it back on. If the two plugins cannot share a login, keep the security plugin's own URL setting and remove the other one.
Email support@webji.services if the site is on WebJi® and the file manager is new to you. The inbox is staffed 24/7 in Hindi and English, and the first reply is usually under 60 minutes. The office phone is not the support line.
What still stops a guessed password?
A hidden URL only removes the well-known door. After the 404 test, add the checks below.
- Turn on two-factor authentication for every administrator. A code after the password still blocks a person who learned the slug.
- Cap failed tries, then block that address for a while. The hide-login plugin does not do this by itself.
- Turn XML-RPC off unless the WordPress app or a remote publisher needs it. It accepts password attempts on a different path.
Sites on WebJi® WordPress hosting still share an IP with other accounts. Fewer bots posting to /wp-login.php means less noise on that IP. A person who has the slug still needs the second factor. WordPress security covers that setup if you would rather not wire it yourself.
Frequently Asked Questions
How do I change the WordPress login URL?
Install one plugin such as WPS Hide Login, set a private slug under its settings, and save. Log in at the new address in a private window. /wp-login.php should 404. Bookmark the new address before you close the dashboard.
What is the default WordPress login URL?
It is /wp-login.php on your domain. /wp-admin redirects there until you change it. A site in a subfolder keeps that folder in the path.
Will changing the login URL break my site?
The public pages stay up. You can lose the dashboard if you log out before the new slug works, or if two plugins both rewrite the login. Test in a private window first, and keep a backup.
What if I forget the new login URL?
Rename the hide-login plugin folder inside wp-content/plugins by FTP or the file manager. WordPress turns the plugin off, and /wp-login.php works again. Set a new slug and write it down.
Does a new login URL stop brute-force attacks?
It stops scripts that only know the default path. It does not stop someone who has the new slug, and it does not replace two-factor authentication or a limit on failed tries.
Can I change the login URL without a plugin?
A rewrite that still loads wp-login.php does not hide that file. Renaming the core file is undone by the next WordPress update. Use one plugin, and leave the core file in place.