Skip to content

How to change the WP-Admin URL in WordPress? (2024)

How-to-change-the-WP-Admin-URL-in-WordPress

Change your WordPress wp-admin URL to enhance more security of your site.

Changing the wp-admin URL in WordPress involves several steps to ensure the process is done correctly and securely. Below, I’ll provide you with a comprehensive guide on how to achieve this task. Keep in mind that it’s crucial to follow each step carefully to avoid potential issues with your WordPress site.

Before you start:

Back up your entire WordPress website, including the database and files. This is essential in case anything goes wrong during the process.

If you are new to WordPress, then we recommend you hire a developer or consult an experienced WordPress user.

Make sure you have access to your web hosting account and FTP (File Transfer Protocol) or cPanel to manage your website’s files. You can install FileZilla to edit and update files on your server.

Step 1: Create a new WordPress login URL:

wps-hide-login-plugin

To change the wp-admin URL, you’ll need to create a custom login URL that is not easily guessable. This will add an extra layer of security to your site.

  • Log in to your WordPress dashboard.
  • Go to “Plugins” > “Add New.”
  • Search for a plugin that allows you to change the login URL. Some popular plugins for this purpose include “WPS Hide Login,” “Hide My WP,” and “iThemes Security.”
  • Install and activate the plugin of your choice.

Step 2: Change the wp-admin URL:

custom-login-url

With the custom login URL plugin activated, you can now change the default wp-admin URL.

  • Go to “Settings” > “General” in your WordPress dashboard.
  • Look for the section “Custom Login URL” or a similar option provided by the plugin you installed.
  • Enter your desired custom login URL. This could be anything unique and difficult to guess, such as “my-secret-login” or “secure-access-only.”
  • Save the changes.

Step 3: Update website URLs:

better-search-replace-plugin

Changing the wp-admin URL can sometimes cause issues with internal links and scripts. To avoid these problems, you need to update website URLs in the WordPress database.

  • Install and activate the “Better Search Replace” plugin. This tool allows you to replace old URLs with new ones in your database.
  • Go to “Tools” > “Better Search Replace.”
  • In the “Search for” field, enter the current wp-admin URL (e.g., “/wp-admin”).
  • In the “Replace with” field, enter the new custom login URL you created in Step 2.
  • Select all the tables in your database. You can usually find them listed in the left-hand column.
  • Uncheck the “Run as dry run?” option (this ensures the actual replacements are made).
  • Click on the “Run Search/Replace” button.

change-URLs-using-better-search-replace-plugin

Step 4: Modify .htaccess file:

change-code-in-htccess-file

Now, you’ll need to edit the .htaccess file to handle the URL rewriting for the new wp-admin location.

  • Connect to your website using FTP or cPanel.
  • Locate the .htaccess file in the root directory of your WordPress installation.
  • Download a backup of the .htaccess file to your computer.
  • Open the .htaccess file in a text editor (such as Notepad or Sublime Text).

Add the following lines at the beginning of the file:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^my-secret-login$ /wp-login.php [QSA,L]
</IfModule>

  • Replace “my-secret-login” with your custom login URL.
  • Save the changes to the .htaccess file.
  • Upload the modified .htaccess file back to the root directory of your WordPress installation, replacing the old one.

Step 5: Test the new login URL:

To ensure that the new custom login URL is working correctly, you should test it.

  • Open a new browser tab.
  • Enter your website URL followed by the custom login URL you created (e.g., “https://www.example.com/my-secret-login”).
  • Check if you can access the WordPress login page.

Step 6: Update Permalinks (Optional):

save-permalinks

Changing the wp-admin URL might affect your permalink structure, resulting in broken links. To fix this, update your permalink settings.

  • Go to “Settings” > “Permalinks” in your WordPress dashboard.
  • Without making any changes, click the “Save Changes” button. This refreshes the permalink settings and fixes any potential issues.

Step 7: Revoke previous access (Optional):

For added security, consider revoking access to the default wp-admin URL. This way, only your new custom login URL will work.

  • Connect to your website via FTP or cPanel.
  • Locate the .htaccess file in the root directory of your WordPress installation.
  • Open the .htaccess file in a text editor.

change-code-in-htccess-file

Add the following lines at the end of the file:

# Block access to default wp-admin
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^wp-admin/(.*)$ /path/to/error-page [R=301,L]
</IfModule>

  • Replace “/path/to/error-page” with the URL of a custom error page or any other page you want to display when someone tries to access the default wp-admin URL.
  • Save the changes to the .htaccess file.
  • Upload the modified .htaccess file back to the root directory of your WordPress installation, replacing the old one.

In a nutshell, changing the wp-admin URL in WordPress involves multiple steps, and it’s important to proceed with caution. Always back up your site before making any changes and follow each step carefully to avoid issues. Additionally, choose a custom login URL that is difficult to guess and consider using a security plugin to enhance your website’s protection further.

Remember that the specific steps or plugins mentioned in this guide may vary depending on your WordPress version and the plugins available at the time you perform this task. Always refer to official documentation and follow best practices for WordPress security.

Changing the wp-admin login URL without a plugin

Changing the wp-admin URL without using a plugin can be achieved by following a series of steps that involve modifying core WordPress files and server configurations. It is essential to proceed with caution as any incorrect changes could break your website or lead to security vulnerabilities. Always make a backup of your site before attempting these modifications. Additionally, this process may require access to your website’s files and server settings, so make sure you have the necessary credentials and permissions.

Before we begin, let’s understand what we are trying to accomplish and why. Changing the default wp-admin URL can enhance your website’s security by making it harder for attackers to find the login page. The default login URL (www.yourdomain.com/wp-admin) is well-known and can be targeted in brute-force attacks. Changing it to something unique and less predictable can reduce the risk of unauthorized access.

Please note that this section assumes you have basic knowledge of WordPress, PHP, and server management. Follow the steps carefully, and if you encounter any issues, revert back to your backup or seek professional assistance.

Step 1: Create a new login page template

  • Connect to your website via FTP or the File Manager provided by your hosting provider.
  • Navigate to your theme folder (usually located in wp-content/themes/).
  • Create a new file named custom-login.php. This will be the template for the new login page.
  • Add the following code to custom-login.php:

<?php
/**
* Template Name: Custom Login
*/

// Place the code for the custom login page here

 

Step 2: Customize the new login page

You can now customize the custom-login.php file to create your unique login page. You can use HTML, CSS, and JavaScript to design a login form that suits your website’s theme and branding. Make sure the form includes fields for the username/email and password and a submit button.

Step 3: Create a new page using the custom template

  • Log in to your WordPress dashboard.
  • Go to Pages > Add New.
  • Give the new page a suitable title, like “Custom Login.”
  • On the right-hand side, look for the “Page Attributes” box.
  • Under “Template,” select “Custom Login” (the template we created in Step 1).
  • Publish the page.

Step 4: Adjust the login URL

Now that we have a custom login page, we need to redirect the default /wp-admin/ URL to our new page.

  • Access your website’s .htaccess file. This file is located in the root directory of your WordPress installation. Make sure to create a backup of this file before making any changes.
  • Add the following lines at the end of the .htaccess file:

RewriteEngine On
RewriteRule ^my-login$ /index.php?pagename=custom-login [L]

Note: In the code above, replace ‘my-login’ with the slug you want to use for the new login URL.

Step 5: Update the WordPress login URL

  • Connect to your website via FTP or the File Manager provided by your hosting provider.
  • Locate the wp-login.php file in the root directory of your WordPress installation.
  • Create a backup of the wp-login.php file.
  • Edit the wp-login.php file and look for the following line:

require( dirname(__FILE__) . ‘/wp-load.php’ );

  • Replace it with:

require( dirname(__FILE__) . ‘/wp-load.php’ );

if ( isset( $_GET[‘action’] ) && $_GET[‘action’] !== ‘logout’ ) {
wp_redirect( home_url( ‘/my-login’ ) );
exit;
}

In the code above, replace /my-login with the custom login URL slug you defined in Step 4.

Step 6: Update the logout URL

When users log out, they are usually redirected to the default /wp-login.php URL. We need to change this to redirect them to the custom login page.

  • Edit your theme’s functions.php file (located in wp-content/themes/your-theme-name/).
  • Add the following code to the functions.php file:

function custom_logout_redirect() {
wp_redirect( home_url( ‘/my-login?action=logout’ ) );
exit;
}
add_action( ‘wp_logout’, ‘custom_logout_redirect’ );

Again, replace /my-login with the slug of your custom login URL.

Step 7: Test the new login URL

With all the changes in place, test your new login URL by visiting www.yourdomain.com/my-login. Ensure that the login page displays correctly and that you can log in with your credentials.

Step 8: Update your links and bookmarks

To ensure a smooth user experience, update any internal links or bookmarks that point to the old /wp-admin/ URL. Replace them with the new custom login URL (www.yourdomain.com/my-login).

Step 9: Clear caches and re-login

If you use any caching plugins or server-level caching mechanisms, clear them to ensure that the changes take effect. Afterward, log out and log back in using the new custom login URL to verify that everything is working correctly.

Step 10: Finalize security measures

While changing the login URL improves security, it’s essential to implement other security best practices. This includes using strong passwords, limiting login attempts, and keeping your WordPress installation, themes, and plugins up-to-date.

In conclusion, changing the wp-admin URL without using a plugin requires editing core WordPress files and server configurations. Proceed with caution, and make sure to create backups before making any changes. By following the steps outlined above, you can enhance your website’s security and reduce the risk of unauthorized access to the login page.

Enhancing WordPress Security: The Importance of Changing the wp-admin URL

Enhancing-WordPress-Security-The-Importance-of-Changing-the-wp-admin-URL

WordPress is one of the most popular content management systems (CMS) on the internet, powering millions of websites across the globe. As with any widely-used platform, its popularity also attracts the attention of hackers and malicious actors seeking to exploit vulnerabilities.

One of the critical components of WordPress is the “wp-admin” directory, which serves as the gateway to the website’s administrative panel. Changing the default URL of the wp-admin directory is an essential security measure that website owners and administrators should consider to safeguard their websites from potential cyber threats.

This section delves into the reasons why changing the wp-admin URL is crucial in fortifying WordPress security.

Prevention of Brute Force Attacks

Brute force attacks are among the most common and straightforward methods employed by hackers to gain unauthorized access to WordPress sites. In this type of attack, malicious actors use automated tools to repeatedly attempt various username and password combinations until they find the right one. The default wp-admin URL is well-known, making it an attractive target for these attackers. By changing the default URL to something unique and obscure, website owners can make it significantly more challenging for hackers to launch brute-force attacks successfully.

Mitigation of Automated Scanning

Hackers employ automated scanning tools to search for vulnerabilities in websites, including default wp-admin URLs. Changing the wp-admin URL can help mitigate these scans, as automated tools will struggle to identify the new URL. This reduces the likelihood of your website being targeted and minimizes the exposure of potential security flaws.

Enhanced Protection against Unauthorized Access

Changing the wp-admin URL adds an extra layer of protection against unauthorized access to the website’s backend. Even if an attacker knows the username and password, they will still have to discover the custom wp-admin URL to proceed further. This significantly lowers the risk of unauthorized access, especially if the new URL is carefully chosen to be difficult to guess.

Obscurity as a Security Strategy

Obscurity is often considered a weak security measure when used alone. However, when combined with robust security practices, it can provide a valuable deterrent to attackers. Changing the wp-admin URL introduces an element of obscurity, making it harder for attackers to determine the entry point to the website’s admin area.

Reduction of Vulnerabilities in Plugins and Themes

Plugins and themes are essential elements of WordPress websites, but they can also introduce vulnerabilities if not kept up to date or developed securely. Some plugins might inadvertently expose the wp-admin URL or create other vulnerabilities, making it easier for attackers to exploit the site. By changing the wp-admin URL, you can minimize the impact of such plugin or theme-related vulnerabilities.

Protection against Known Exploits

As WordPress is open-source software, the code is accessible to everyone. This includes both developers seeking to contribute to the platform’s improvement and malicious actors looking for
potential weaknesses. Over time, certain vulnerabilities in the default wp-admin URL may become widely known and exploited. By changing the URL, you reduce the risk of falling victim to known exploits.

Guarding against Malicious Crawlers

Malicious crawlers are automated bots that scrape websites for sensitive information or attempt to disrupt their normal operations. They can be programmed to target the default wp-admin URL, causing potential harm to the site. Changing the wp-admin URL makes it more challenging for these crawlers to locate and target the admin area.

Protection during Website Migration

Website owners often migrate their WordPress sites from one hosting provider to another. During this process, hackers might exploit the vulnerability of the default wp-admin URL, especially if temporary URLs are used during migration. Changing the wp-admin URL before or after migration ensures that the website remains secure throughout the process.

Conclusion

To summarize, changing the wp-admin URL is a crucial security measure that WordPress website owners and administrators should implement. By doing so, you can strengthen your website’s defenses against brute force attacks, automated scans, unauthorized access, and known exploits. Additionally, it adds a layer of obscurity that can be valuable when combined with other security best practices.

Protecting your website from potential cyber threats is an ongoing task, and changing the wp-admin URL is an essential step in fortifying your WordPress security. Always remember to back up your website and test any changes thoroughly before implementation to ensure a smooth and secure experience for both yourself and your users. Even using any WordPress security plugins might not help if you have taken proper measures.

Now over to you, 

Do you have trouble changing the wp-admin URL of your WordPress site?

Do you think it is necessary to change the site wp-admin URL to a different URL?

Please let us know your thoughts and follow us on Facebook and Twitter.