How to Change Your WordPress Login URL (With or Without a Plugin) 

Add wp-admin to the end of any WordPress site and you land on its login form. Every bot scanning the web knows that, which is why your login page is the first door they try.

Changing your WordPress login URL takes that easy target away. I’ll show you both ways to do it, and which one does what people assume it does.

Why Change Your WordPress Login URL?

Because the default address is public knowledge. Anyone can find your default login page by adding “wp-admin” or “wp-login.php” to your domain.

That makes your login form the easiest thing on the internet to attack. Automated scanners work through a list of sites, hit the same two paths, and start guessing.

Moving that form somewhere else means the scanners find nothing at the address they expected. It’s one of the first things I set up on any site with more than one user, alongside the rest of the basics.

I’ve been working with WordPress for over 15 years, and this is the change people most often get half right. They move the URL, assume they’re done, and skip the part that actually stops an attack.

• Why Change Your WordPress Login URL?
• Which Method Should You Use?
• How Do I Change the WordPress Login URL Without a Plugin?
• How Do I Create a Custom WordPress Login Page With SeedProd?
• What Should I Do If My Custom Login URL Stops Working?
• How Do I Secure My WordPress Login Page Further?
• WordPress Login URL FAQs

Which Method Should You Use?

It depends on whether you want to hide the login form or redesign it. Those sound like the same job and they aren’t.

What you want	Use this	Why
The login form gone from wp-login.php	The manual method	It’s the only option here that stops the default file serving your login form
A branded login page for clients or members	SeedProd	A designed page with no code, and visits to wp-login.php get sent to it
Actual protection from password guessing	A login limiter plus two-factor authentication	A different address slows scanners down. It doesn’t stop someone guessing credentials

If you came here for security, start with the manual method below, then add the login limiter and two-factor authentication. If you came here because the default WordPress login screen looks nothing like your brand, skip ahead to the SeedProd method.

How Do I Change the WordPress Login URL Without a Plugin?

You copy wp-login.php, rename it, and then tell WordPress to use the new file. It’s the more advanced route, so only take it if you’re comfortable with a file manager and a little PHP.

Back up your site before you touch anything. You can use this guide to backing up WordPress, or your host’s own backup tool. I’m using Bluehost here, which includes a file manager for editing core files.

You’ll also want a plain text editor. I’m using VS Code, but Notepad++ works just as well.

Step 1. Download Your wp-login.php File

Your wp-login.php file holds the code that builds your login page, so this is the file you need to change.

Open your host’s file manager and find the folder called “public_html.” In Bluehost, open your site, click the Settings tab, then the File Manager button.

In the file manager’s left sidebar, click the public_html folder. Find wp-login.php and download it to your computer.

Step 2. Find and Replace the Old Login URL

Open wp-login.php in your text editor. Search for every instance of “wp-login” and replace it with your new login slug.

Mine is “wp-new-signin,” but pick something unique to your site that you’ll remember. Avoid the obvious guesses like “login” or “admin.”

Save the file, then rename it to match the slug you just used. In my case that’s wp-new-signin.php.

Step 3. Upload Your New Login File

Go back to your file manager, upload a new file, and choose the renamed file from the last step.

Step 4. Register Your New Login URL Using Filter Hooks

WordPress still generates links to the old address, so you need to tell it about the new one with the login_url filter hook.

Add the logout_url and lostpassword_url hooks too. Without them, WordPress sends people back to wp-login.php when they log out or reset a password, which defeats the whole exercise.

/*
 * Change the WP login file URL using the "login_url" filter hook
 * https://developer.wordpress.org/reference/hooks/login_url/
 */
add_filter( 'login_url', 'custom_login_url', PHP_INT_MAX );
function custom_login_url( $login_url ) {
    $login_url = site_url( 'wp-new-signin.php', 'login' );
    return $login_url;
}

/*
 * Also send logout and lost password back to the new login URL
 */
add_filter( 'logout_url', 'custom_logout_url', PHP_INT_MAX );
function custom_logout_url( $logout_url ) {
    return site_url( 'wp-new-signin.php', 'login' ) . '?action=logout&_wpnonce=' . wp_create_nonce( 'log-out' );
}

add_filter( 'lostpassword_url', 'custom_lostpassword_url', PHP_INT_MAX );
function custom_lostpassword_url( $lostpassword_url ) {
    return site_url( 'wp-new-signin.php', 'login' ) . '?action=lostpassword';
}

Save the file and activate the plugin.

Step 5. Test Your New Login URL

Test the new address before you change anything else. Type your domain in the browser and add your new login slug to the end.

So the full URL would look like this: startupyourwpsite.com/wp-new-signin.php

If you see the login form, it works. Log in, log out, and run a password reset before you go any further, because those are the paths people most often break.

Step 6. Leave the Original wp-login.php Alone

Most guides tell you to delete wp-login.php at this point. Don’t. WordPress ships that file as part of core, so the next core update puts it straight back.

So you spend a few weeks believing that file is gone, an update puts it back, and nothing tells you. That’s worse than knowing it’s there.

There’s a second problem with this method that nobody mentions. Your renamed copy of wp-login.php is frozen at the version you downloaded, so it stops receiving the fixes core ships for that file.

So treat the new URL as one layer, not the finish line. The extra steps further down are what actually stop someone guessing their way in.

How Do I Create a Custom WordPress Login Page With SeedProd?

You use SeedProd’s Login Page mode to design a login page at a URL you choose, then send visits to wp-login.php over to it. No code involved.

SeedProd is a drag-and-drop website builder for WordPress used by over 1 million site owners. Its Login Page mode replaces the plain grey WordPress login screen with something that looks like your brand.

It’s the right tool for a branded login page. It’s the wrong tool if your goal is hiding the login form from bots.

SeedProd’s own documentation says the same thing in gentler words: the redirect covers most visits, and the default page still handles password resets, login errors, logouts and registration. So use it for design, and use the manual method or a login limiter for security. Here’s how to set it up.

Step 1. Install and Activate SeedProd

Login Page mode is a paid feature, so you’ll need SeedProd Basic or above. Grab a copy here, then install and activate it on your site. If you’ve not done that before, here’s how to install a WordPress plugin.

SeedProd asks for your license key on first run. You’ll find it in the downloads section of your SeedProd account. Paste it in and click Activate Key.

Step 2. Set Up a Login Page

Head to the SeedProd dashboard, where you’ll see four page modes you can switch on and off with a click:

• Coming Soon Mode
• Maintenance Mode
• Login Page
• 404 Page

Click Set up a Login Page to get started.

SeedProd filters its template library down to login page templates, so you’re not hunting through hundreds of designs. Hover over one and click the checkmark to pick it.

A popup asks for your page name and URL. This is where you set the custom address, so pick something that isn’t a guess away from “login.”

Click Save and Start Editing the Page to open the template in the visual editor.

Step 3. Customize Your Login Page

Blocks sit on the left, your live page on the right. Drag a block onto the page and you see the change immediately.

Click any element to open its settings. Adding a Text block under the headline is a good spot for login instructions, which is the kind of small touch clients notice.

The Global Settings panel, behind the cog icon in the bottom left, changes your fonts, colors and background all at once instead of block by block.

Swap the background image in the Background tab, then set link, text, button and headline colors from the Colors tab.

Click Save in the top right when you’re happy with it.

Step 4. Publish Your Login Page

Open the dropdown next to the Save button and click Publish.

Step 5. Turn On Login Page Mode

Back on the SeedProd dashboard, find Login Page mode and flip the toggle from Inactive to Active. Your custom page is now live at the URL you chose.

There’s a separate setting called Redirect the Default Login Page. Switch that on and someone typing wp-login.php gets sent to your page instead of the grey default.

Your login screen now looks like your site, and nobody had to open a file manager. Just remember what that redirect does and doesn’t cover.

What Should I Do If My Custom Login URL Stops Working?

Three things break this, and all three are recoverable. Here’s how to fix each one.

I Forgot My Custom Login URL

Open your site specific plugin file, or your child theme’s functions.php, and look for the custom_login_url function. Your URL is inside the site_url() call.

Locked out completely? Connect over FTP, find the file, and read it there. As a last resort, rename your /wp-content/plugins/ folder to plugins-disabled, which deactivates everything and restores the default wp-login.php address.

Getting a 404 Error After Changing the URL

A 404 means one of two things: the filename in your code doesn’t match the file you uploaded, or your permalinks need refreshing.

Go to Settings » Permalinks and click Save Changes without editing anything. Then check the filename in your plugin file character for character against the uploaded file.

Stuck in a Redirect Loop

A loop nearly always means a plugin conflict. Connect over FTP, go to wp-content/, and rename the plugins folder to plugins-disabled to switch everything off at once.

Log in at the default address, rename the folder back, then reactivate plugins one at a time until the loop returns. The last one you switched on is your culprit.

How Do I Secure My WordPress Login Page Further?

By adding the layers that stop credential guessing, because moving the URL doesn’t. Once a scanner finds your new address, you’re back where you started.

These four are worth more than the URL change on its own:

• Limit login attempts. WordPress allows unlimited guesses out of the box. A limiter cuts an attack off after a handful of tries, whatever address the form sits at. If you only do one thing from this list, do this one.
• Turn on two-factor authentication. Someone with your password still can’t get in. Several WordPress security plugins include it free.
• Use strong, unique passwords. A custom URL counts for nothing behind a password someone can guess. Let a password manager generate them.
• Keep WordPress and your plugins updated. Security fixes ship inside updates, so running old code leaves known holes open. That undoes everything else on this list.

For the wider picture, see our guide to 11 ways to secure your WordPress website against hackers.

WordPress Login URL FAQs

Does changing the WordPress login URL actually stop brute-force attacks?

No, it reduces them. Moving the URL hides your login form from scanners working through the standard paths, which cuts the noise in your logs a lot. But anyone who finds the new address can still guess passwords at it, and some methods leave wp-login.php answering requests anyway. Pair the URL change with a login attempt limiter and two-factor authentication.

What is the difference between wp-admin and wp-login.php?

wp-login.php is the file that builds your login form. /wp-admin is your dashboard. When you visit /wp-admin without being logged in, WordPress sends you to wp-login.php and then back to the dashboard afterwards. That’s why both addresses appear to be your login page, and why changing the login URL means changing what wp-login.php does.

Does changing my login URL affect my site’s SEO?

No. Your login page isn’t indexed and carries no ranking value, so moving it changes nothing in search. The one thing to watch is your custom slug clashing with a real page or post URL. Pick something that isn’t a word you’d ever use for content and you’ll never hit it.

Can I change the login URL on WordPress.com?

Not on the free or lower plans. WordPress.com handles logins through its own accounts system, so there’s no wp-login.php file for you to move and no plugin installs on those tiers. You’d need a plan that allows plugins, or a self-hosted WordPress site.

That’s both methods. If you want the login form gone from its default address, take the manual route and diary that post-update check. If you want a login page that looks like your brand, set one up with SeedProd today and you won’t touch a single file.

Please see the following guides for more login and registration page advice:

• 14 Stunning Login Page Examples to Inspire Your Next Design
• How to Create a Client Login Page in WordPress (2 Methods)
• 11 Best Content Locker WordPress Plugins
• How to Password Protect a WordPress Page (Step by Step)
• How to Create a WordPress Custom Login Page (Easy Steps)

Thanks for reading! We’d love to hear your thoughts, so please feel free to join the conversation on YouTube, X and Facebook for more helpful advice and content to grow your business.