Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Is it possible to rename the wp-admin folder?

I know I could just rename it, but unless it's supported by the code lots of things would break.

If I use a custom folder name, it will make it slightly more secure, security by obscurity and all that.

share|improve this question
add comment

10 Answers

up vote 16 down vote accepted

Unfortunately it's not currently possible nor does there appear to be will to consider it as a modification as you can see by this recent thread on the wp-hackers list and this ticket on trac.

If you'd really like to see this be revisited I'd suggest:

  1. Present your case on wp-hackers but be forewarned your use-case better be good and not "security through obscurity" or it will get shot down as above.

  2. Present your argument in a trac ticket with the same caveats.

  3. Even better, upload a patch to trac that enables your desired functionality. It's much harder to say no when the work has already been done (but of course, they do have a preference for saying "no" a lot more often than they say "yes" so be forewarned.)

share|improve this answer
1  
+1 they do have a preference for saying "no" a lot more often than they say "yes" so be forewarned :) –  Sisir Nov 29 '13 at 5:18
add comment

No, you cannot rename the folder. The path is hard-coded in multiple locations throughout WordPress' source.

Security through obscurity isn't really security anyway.

share|improve this answer
5  
And it's a lazy excuse at best for not changing bad programming practices like hard-coding magic numbers or strings. –  hakre Jan 10 '11 at 12:05
3  
@hakre +100 Btw, most people asking how to hide "wp-*" folders are not necessarily looking for security, they are looking for obscurity actually..they try to make analyzing their sites more effort-requiring activity. –  Victor Farazdagi Jul 5 '11 at 11:19
    
Actually, it's not security by obscurity. It's Obscure URL, a valid security technique. See answer below for details. –  cmc Mar 15 '13 at 11:47
1  
Well, I tried following up with a fresh set of arguments, but the answer was: "This is a strong wontfix in by book" and the rather snotty "the gmail login isnt obscure url either". No technical reasons, no explanation, no debate, they just won't do it. –  cmc Mar 19 '13 at 10:50
add comment

If you want to keep subscriber-level users from seeing the wp-admin directory, you can create standalone versions of the login/registration and profile/edit pages in their own directories. Then, you can protect your admin folder via htaccess or IP restriction. (Though if you do this, you should make an exception for the admin-ajax file, as some plugins use it to add, um, AJAX functionality).

This approach gives you the "obscurity" you want (which doesn't really do much, but often makes clients and managers feel better), and also adds some real security by limiting access to the admin. Plus, honestly, a URL that just says "/login" looks a lot nicer than "wp-login.php".

It should go without saying that this doesn't make your site bulletproof. But it's a nice, basic enhancement.

share|improve this answer
add comment

There is actually a very good tutorial on this here:

How to Hide WordPress Info from Your Source Code mirror

Includes how to rename wp-content, rename wp-admin, and remove the generator tag from WordPress.

This tutorial will change obvious evidence or indications of it in your source-code, effectively removing WordPress info from your site.

It explains how to change the folder name, the wp-admin login url, and make sure that login.php redirects to the main site so that people can go there directly.

share|improve this answer
add comment

One way to lock down the administrative control panel is to utilize .htaccess rules. Just add an .htaccess file to the root of the wp-admin directory. After you add this file, just add the following rule to deny all IP addresses and allow only your IP:

http://wp.tutsplus.com/tutorials/10-steps-to-securing-your-wordpress-installation/

AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName "WordPress Admin Access Control"
AuthType Basic
<LIMIT GET>
order deny,allow
deny from all
whitelist address
allow from <IP ADDRESS HERE>
</LIMIT>
share|improve this answer
add comment

An approach that is officially supported by WordPress is to move the WordPress installation files into a sub-directory, while keeping the site in the root, like so:

Site URL: http://my-blog.com

Admin URL: http://my-blog.com/7nxnkkugrdzm/wp-admin

While this does not give you complete freedom in changing your admin url, it means you can prefix it with anything you like. This is just as good from a security point of view. It also has the benefit of moving all the WordPress installation files into a location unknown to users, so it should be part of any wordpress hardening strategy.

From the WordPress Codex: Giving WordPress Its Own Directory

Also, note that while this security scheme is called Obscure URL, it is not the same thing as security by obscurity. Obscure URL is a perfectly valid security scheme that is just as good as a password, while security by obscurity relies on using secret unproven procedures.

The same caveats apply though as with passwords: Call the custom folder something like 7nxnkkugrdzm, not happy-snappy-admin. Also, make sure your users are aware the admin url is a secret.

share|improve this answer
add comment

Take a look at http://wordpress.org/extend/plugins/stealth-login/ this may help you out.

share|improve this answer
    
I had issues with that plugin when I tried it. And it currently doesn't seem to be maintained or compatible with WP 3.x –  Rarst Nov 14 '10 at 21:41
    
ah... to bad, did not check it, i deinstalled it some time ago. But hey... maybe someone can fix it if in real need. –  edelwater Nov 15 '10 at 0:58
    
as an alternative, please see wordpress.stackexchange.com/questions/4037/… –  hakre Jan 10 '11 at 12:07
add comment

No it's not possible to rename the wp-admin folder with any short of code or htaccess hack,

In the past i done the same for a client by performing a complete folder search via Coda (the editor i use) for the tag "wp-admin, wp-content...etc" and i remove the "wp-" from the files.

After that you will be able to install it but:
You have to do the same with the plugins you want to install, You have to update the core manually by clearing the "wp-" tag from the new versions.

In all the ways i don't suggest you to do something like this, leave it as is and try to implement a User Login/Register/Profile page to give your users/clients a better experience.

Cristian from Cozmolabs have write a very good tutorial. You can edit the code a bit and make it run in any WordPress theme.

You can also add a Post form from the frontend so the Admin and Users with the Capabilities to write a post can do it from the frontend.

Here you can see an example and code on how to create a Frontend Post page. Fron-End Post Submission

Also you can take a look for some nice plugins here that do the same with more functionality.

share|improve this answer
add comment

I have used a combination of a modified .htaccess and then a symlink to successfully change the wp-admin url and it has worked fine across many sites with various themes and hundreds of pluggins. No hacking finding/replacing etc. needed.

share|improve this answer
3  
... got details? –  cmc Mar 13 '13 at 11:07
add comment

Yes. Its possible :)

I make a easiest way for rename /wp-admin/ folder. Please check it.

http://alshedupur.com/fully-secure-your-wordpress-site/

I hope its work for all. No htaccess needed :)

share|improve this answer
8  
Welcome to WordPress Answers! An answer should be more than just a link to an external site. Please add a solution. The page you linked to recommends to change many core files. This is the worst “solution” for this problem. –  toscho Aug 1 '12 at 11:42
1  
Hacking core files (outside of core development) is never a good practice. Ever. –  Brian Fegter Aug 1 '12 at 12:25
    
Hello @toscho , Please just follow Step 2 from this website post. I hope its solved your problem. .htaccess is not a permanent solution for this problem. I share this post, because user need to secure their website. anyway, thanks for your comments :) –  Alshe Dupur Aug 1 '12 at 14:21
6  
In no way does this stop a hacker bot. Obscurity is not security. All a hacker needs to do is add your new folder name to their list and you're hosed. Trust me, a new folder name is easy to figure out. If they are targeting a specific site (yours), chances are they know as much or more about your server than you do via thorough research. –  Brian Fegter Aug 1 '12 at 14:27
2  
If you need to completely lock down wp-admin, it's best to let the server restrict IP addresses. This is the best way to keep people out. –  Brian Fegter Aug 1 '12 at 14:31
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.