Hide your WordPress login page

What it does

The overwhelming majority of login attacks are automated scripts pointed at wp-login.php and wp-admin. This module gives your site a secret login address and decides what everyone else sees when they try the default one.

By default, visitors who request the old login URLs get a standard 404 page, as if the login did not exist. You can send them to the homepage instead.

How it works

The plugin removes WordPress's admin redirect shortcuts and routes your chosen slug to the real login form. It also ships an optional login consent banner (useful for GDPR notices) and an HTTP Basic Auth guard that can put a second password prompt in front of the login page itself.

• Custom login slug of your choosing
• Default-login visitors see a 404 (or the homepage, your call)
• Optional login consent banner with editable text
• Optional HTTP Basic Auth in front of the login (10 failures, 15-minute lockout, trusted IPs)

Good to know

Works alongside caching plugins and CDNs. Exclude your login path from full-page caching, as with any login page. Hiding the login is one layer, not the whole story: pair it with two-factor authentication and brute-force limiting, which the free plugin also includes.