WordPress Custom Login URL: Setup And Considerations

The default WordPress login URL is universally known. Every WordPress site uses wp-login.php; every attacker targets it. Custom login URLs reduce attack volume by moving the login away from the predictable path.

The setup is simple but the considerations matter. Done well, it provides meaningful security improvement. Done poorly, it creates lockout risks.

The setup with WPS Hide Login

Install WPS Hide Login plugin.

Set the custom login URL in plugin settings. Something obscure like /yoursite-secret-portal-2026/.

Set the redirect URL for attempts to wp-login.php. Typically a 404 or the homepage.

The plugin handles the redirect; users hitting the old URL get redirected; the new URL provides login access.

The URL choice

The URL should be obscure enough that automated scanning won't find it. Avoid:

/admin (obvious)

/login (obvious)

/secure-login (still obvious to attackers checking common patterns)

Use something specific to your site that an attacker wouldn't guess. The obscurity is the security benefit.

The lockout prevention

If you lose access (forget the URL, the plugin breaks), you can't log in. The recovery:

1. FTP access to the site files.

2. Rename the WPS Hide Login plugin folder to disable it.

3. Log in via the default wp-login.php URL.

4. Re-enable the plugin and reconfigure if desired.

Document the custom URL somewhere accessible. The password manager or a personal documentation system.

The bookmark consideration

Once the custom URL is set, bookmark it. The bookmark prevents needing to remember the URL.

For teams, share the URL through secure channels. Don't email it in plain text; use the team's password manager.

The complementary measures

Custom login URL is one layer of login security. Other layers:

Two-factor authentication on admin accounts (covered in detail in previous post).

Limit failed login attempts.

Strong password requirements.

The combination produces login that's resistant to most automated attacks.

The honest framing

Custom login URLs aren't perfect security but they reduce attack surface meaningfully. The setup is 30 minutes; the benefit is reduced login attack volume.

For sites with any login attack pressure (which is most public-facing WordPress sites), this is worth doing.