WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For security reasons, it should be possible to rename login.php to something different, and change other access shortcuts (eg: wp-admin) to point to the new URL.

Is there a documented best practice for this? If not, what would the most correct methodology be?

I appreciate that this is not security per se, just obfuscation, but I'm considering this to be just another layer of protection: not a replacement of other security tactics such as failed attempt lockdown limiting and stricted password enforcement.

Creative approaches welcome.

share|improve this question
This is not a security feature. See Bruce Schneier: The Non-Security of Secrecy. wp-admin is hard coded. – toscho Feb 21 '12 at 16:30
Security by obscurity is not security. Besides. wp-admin and wp-login.php are hard coded -- you're not going to be able to change them unless you hack into the core. – chrisguitarguy Feb 21 '12 at 16:48
It's not really off the radar. You're better off creating a plugin that enforces strict password rules -- not trying to hide a login page. I don't need wp-admin to tell it's a wp site. There are more than a few wonderful features for me to (a) figure that out and (b) start hacking should I choose to do so. The only way an attacker is likely to break in is via brute force password guessing. There are solutions for that: wordpress.org/extend/plugins/simple-login-lockdown – chrisguitarguy Feb 21 '12 at 22:33
@christopherDavis - I agree with all your points, but there is one major reason why some people want to change the login URL and that is the use of BOTS or SCRIPTS that target the specific default wordpress login. it is not the case when a single hacker would target a single website. in that case - it is obviously useless because like you pointed out - knowing that a site runs wordpress is ridiculously easy in most cases. @ Tom Auger - every comment here is basically right.better focus on other security features, and I am not sure why you do not want redirect-rewrites - it is the easiest way. – krembo99 Feb 22 '12 at 1:23
Ok. I +1ed some of the comments above, but the bot attack scripts is still valid. The link @toscho provided is a nice read. But why not add the extra level for the dump attackers... and bots are dump per default - they don't know anything about edge cases. Why? Because they work for 90% of all cases and that's enough. Therefore: Why discuss the why and not the how? – kaiser Feb 22 '12 at 4:18

Well, considering rewrite and redirect like in comments -

choose what fits you best .

HOOK wp_login_url(); //this function generate the login url address


add_filter( 'login_url', 'another_login_url', 10, 2);
function another_login_url( $force_reauth, $redirect ){
    $login_url = 'your_chosen_login_url';

    if ( !empty($redirect) )
        $login_url = add_query_arg( 'redirect_to', urlencode( $redirect ), $login_url );

    if ( $force_reauth )
        $login_url = add_query_arg( 'reauth', '1', $login_url ) ;

    return $login_url ;

Redirect action

add_action( 'login_redirect', 'mysite_login_redirect');
function mysite_login_redirect(){
    return 'your_url';

.htaccess rewrite URL

RewriteRule ^login$ http://site.com/wp-login.php [NC,L]

.htaccess redirect rule

RewriteRule ^login$ http://site.com/wp-login.php [NC,L,R]

Personally I prefer the rewrite function


add_action( 'init', 'k99_login_rewrite' );
function k99_login_rewrite() {
    add_rewrite_rule( 'login/?$', 'wp-login.php', 'top' );

NOTE : some of those methods can change according to wp version, but in the latest versions all should work. THere are also other methods, if you find none of those suitable for you ..

share|improve this answer
Thanks for the response, Krembo. I might be completely misreading this stuff, so forgive me, but it looks like all of your answers but the first don't solve the problem (which is why I originally said "no rewrites" in my OP). The filter is a partial solution perhaps, though it doesn't address wp-admin (you need to use the 'admin_url' filter for that). All the others give you an ADDITIONAL URL you can type in that will take you to wp-login.php. But a hacker can still target wp-login.php directly. – Tom Auger Feb 22 '12 at 19:57
This was an EXCELLENT answer. I found it right after I figured it out, but this was exactly how I did it minus the rewrite stuff. – Jake Feb 21 '13 at 6:45
up vote 0 down vote accepted

The challenge of course is not "breaking" or "hacking" core to do this.

Riffing off of krembo99's filter idea, I wonder whether the following wouldn't be a high-level approach to the solution from a plugin perspective:

  1. copy wp-login.php to a new file in the root WP directory.
  2. Use the 'login_url' filter to point to this new file
  3. Use the 'admin_url' filter to point to a new "pseudo-url" for admin
  4. Set up the 'login_init' action to either just exit, or put up some default error screen, maybe redirect to the 404 page.
  5. Edit the file you copied in step 1 and remove the do_action( 'login_init' ) line (or replace it with a custom action of your own).

I haven't tested this - it's just a theory. The biggest challenge left is - when you upgrade WP - does it delete any files that it doesn't expect in the root? If so, the plugin will also have to check to see if WP has been upgraded and if so, re-install the alternative login file. And of course, we'd want it to be done by copying the newly-upgraded wp-login.php, so it would have to run a regexp search-and-replace on the do_action( 'login_init' ) line.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.