{"id":611,"date":"2026-06-29T11:28:58","date_gmt":"2026-06-29T11:28:58","guid":{"rendered":"https:\/\/brutefort.com\/blog\/how-to-change-wordpress-login-url\/"},"modified":"2026-07-15T13:47:42","modified_gmt":"2026-07-15T13:47:42","slug":"how-to-change-wordpress-login-url","status":"publish","type":"post","link":"https:\/\/brutefort.com\/blog\/how-to-change-wordpress-login-url\/","title":{"rendered":"How to Change Your WordPress Login URL (And Why It Matters)"},"content":{"rendered":"\n
\"URL
Photo by Pixabay from Pexels<\/figcaption><\/figure>\n\n\n\n

Every WordPress site uses the same default login address: \/wp-login.php<\/code>. Bots that run brute force attacks don’t have to search for it. They already know exactly where it lives.<\/p>\n\n\n\n

That’s not a flaw specific to your site. It’s true of every WordPress install by default, which is exactly why automated login-page scanning is so widespread across the web.<\/p>\n\n\n\n

Changing your login URL to something unpredictable closes that gap in under a minute. This guide walks through doing it with BruteFort’s Custom Login URL feature, picking a slug that’s actually secure, and pairing it with rate limiting for full coverage.<\/p>\n\n\n\n

Quick Answer:<\/strong> In BruteFort, go to Settings \u2192 Custom Login URL<\/strong>, toggle it on, enter a slug that isn’t “login,” “admin,” or your brand name, and click Save<\/strong>. Test the new URL in a private window before closing your current admin session \u2014 the default \/wp-login.php<\/code> will return a 404 afterward.<\/p>\n\n\n\n

Why the Default Login URL Is a Security Problem<\/h2>\n\n\n\n

Automated bots scan IP ranges and domain lists looking for known WordPress paths. Finding \/wp-login.php<\/code> confirms a WordPress installation and marks the site for credential testing. This scanning happens around the clock, and it targets sites of all sizes \u2014 a personal blog with ten visitors a day gets the same automated probing as a high-traffic WooCommerce store.<\/p>\n\n\n\n

Hiding your login page doesn’t replace rate limiting \u2014 you should have both \u2014 but it stops the attack before it even starts. A bot that can’t find your login form can’t submit credentials to it. It’s the difference between locking your door and making the door invisible.<\/p>\n\n\n\n

How to Change Your WordPress Login URL with BruteFort<\/h2>\n\n\n\n

BruteFort’s Custom Login URL feature is built specifically for this. Here’s how to set it up:<\/p>\n\n\n\n

  1. Go to BruteFort \u2192 Settings<\/strong> in your WordPress admin.<\/li>
  2. Click the Custom Login URL<\/strong> tab.<\/li>
  3. Toggle Enable Custom Login URL<\/strong> on.<\/li>
  4. Enter your chosen slug in the Login Slug<\/strong> field. This becomes the new path: https:\/\/yoursite.com\/your-slug<\/code>. Pick something unpredictable \u2014 not “login,” “admin,” or “wp,” as these are commonly scanned too.<\/li>
  5. Click Save<\/strong>.<\/li><\/ol>\n\n\n\n
    \"BruteFort<\/figure>\n\n\n\n

    Important:<\/strong> Write down your custom slug before saving. Once the change is active, the default \/wp-login.php<\/code> URL will return a 404. If you forget the slug, you may be locked out of your own site.<\/p><\/div>\n\n\n\n

    After saving, test the new URL in a private browsing window before closing your current admin session. Confirm \/wp-login.php<\/code> now returns a 404, and your new URL loads the login form correctly.<\/p>\n\n\n\n

    \n