Should you change your WordPress login URL?

A guide for site owners. Updated October 17, 2026.

Every WordPress site keeps its login page at /wp-login.php, so that's where bots go to guess passwords. Plugins such as WPS Hide Login move it to an address only you know, like /my-door, and the old one stops answering. It's one of the most popular security tips around. Here's what it actually does.

What it does well

• Less noise. Bots that only know /wp-login.php get nothing, so your logs and your server see far fewer guesses.
• Nothing to set up. Pick an address, bookmark it, done.

What it misses: WordPress has other doors

The login page isn't the only place WordPress takes a username and password. Moving it doesn't move these:

• XML-RPC (/xmlrpc.php): an older way for apps to log in, still on by default, and a favourite of password-guessing bots. Protections that only sit on the login page don't cover it. See the XML-RPC guide.
• WooCommerce's My Account login: on a store, the login form on the account page signs people in without going near wp-login.php.
• Application passwords: WordPress's REST API accepts a username and an application password with each request.

So a bot that's serious about your site skips the login page altogether. And the new address isn't truly secret: it's wherever WordPress links to your login, and anyone you've given it to knows it.

The downsides

• You can lock yourself out. Forget the address and you'll need to turn the plugin off by FTP or your host's file manager to get back in.
• Things can break. Themes and plugins that link straight to wp-login.php, or cache pages, sometimes need extra setup.
• It can feel like enough, and that's the real risk: a weak password behind a hidden door is still a weak password.

So: should you?

It's fine as an extra, if you like quieter logs. It just isn't protection on its own. What actually keeps accounts safe:

1. Limit login attempts on every door: the login page, XML-RPC, WooCommerce's login and application passwords, not just one of them. See the login limits guide.
2. Turn off XML-RPC if nothing you use needs it.
3. Strong, unique passwords and two-factor login for every admin.
4. Hide usernames, so bots have to guess both halves of a login: see the usernames guide.

The free Ropeline plugin guards every door

The free Ropeline plugin works on the login itself, not on its address. 5 wrong passwords in 15 minutes locks an address out, on the login page, WooCommerce's My Account login, XML-RPC and application passwords alike, with lockouts that grow longer each time. When a botnet spreads its guesses over thousands of addresses, it guards the account itself: when one account fails 10 times in an hour from 3 or more addresses, it only opens on devices that have logged in before, for an hour.

It works whether or not you've moved your login page: our compatibility tests run it next to WPS Hide Login.

Questions

I already use a login URL plugin. Should I remove it?

No need. Keep it for the quieter logs, and add limits on every door alongside it.

I moved my login page and forgot the address. How do I get in?

Using your host's file manager or FTP, rename the plugin's folder in wp-content/plugins. WordPress turns the plugin off, and /wp-login.php works again.