Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Any way to change the wp-login.php url? It seems insecure that everyone that's ever used Wordpress could easily see if your site is using it, and get right to the login page.

There used to be a plugin called "Stealth login," but it wasn't updated. (And hence our reluctance to rely on plugins).

share|improve this question
1  
Well...you must also hide /wp-admin/, right? –  Iulian Jan 6 '11 at 2:46

4 Answers 4

up vote 17 down vote accepted

Hi @David:

If you are doing this for your own site then using .htaccess might be the easiest way although it could get tricky if you want to make it work for a plugin as there would be lots of different subtle configuration differences to support.

Here are some articles that could help; not all are directly answering your question but they all address your security concern in one way or another:

And of course that's no blog expert on Apache and WordPress than the guy who writes AskApache. Be sure to check out these:

share|improve this answer
    
Thanks so much for your help! I'll look into those resources. –  David Jan 14 '11 at 3:18
    
wp-login.php still work with rewrite, is right? –  khaled_webdev Feb 4 at 8:48
    
we need fixed ip to use deny from all, allow from Ip, but this technic limit access from anywhere if a person want access from his phone or tablet from a different places that is not in allowed ip. –  khaled_webdev Feb 4 at 9:18

I ran into the same problem recently, and you're right that the Stealth plugin is no longer supported. However, because I finally realized that the Stealth plugin was the best option, I did a clean install of WordPress to the last version of WordPress that the Stealth plugin supported to figure out how the plugin works. Turns out, the only thing that the plugin is doing is creating a .htaccess file with some magic. The .htaccess file will look a little something like this:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^logout wp-login.php?action=logout&_wpnonce=asdfasdf&stealth_out_key=asdfasdfasdfasdf [L]
RewriteRule ^login wp-login.php?stealth_in_key=asdfasdfasdf&redirect_to=http://example.com/login [R,L]
RewriteRule ^admin wp-admin/?stealth_admin_key=asdfasdfasdfasdf [R,L]
RewriteCond %{HTTP_REFERER} !^http://example.com/wp-admin
RewriteCond %{HTTP_REFERER} !^http://example.com/wp-login\.php
RewriteCond %{HTTP_REFERER} !^http://example.com/login
RewriteCond %{HTTP_REFERER} !^http://example.com/admin
RewriteCond %{QUERY_STRING} !^stealth_in_key=asdfasdfasdfasdf
RewriteCond %{QUERY_STRING} !^stealth_out_key=asdfasdfasdfasdfasd
RewriteCond %{QUERY_STRING} !^stealth_reg_key=asdfasdfasdfasdfasdf
RewriteCond %{QUERY_STRING} !^stealth_admin_key=asdfasdfasdfasdfasdf
RewriteRule ^wp-login\.php http://example.com [R,L]
RewriteCond %{QUERY_STRING} ^loggedout=true
RewriteRule ^wp-login\.php http://example.com [R,L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

I have changed all of the keys to some variation of "asdfasdfasdf" -- obviously you would need to create some secret keys for yourself.

Hope this helps!

share|improve this answer
    
Thanks for that! I'll try it and get back to you. –  David Jan 14 '11 at 3:18

or you could rename from wp-login.php to some-obscure-name.php, then when you want to login, type your url/some-obscure-name.php instead of going to wp-admin.php

share|improve this answer
2  
I am fairly sure that if you did this and this alone there would be numerous problems with functionality. How would you compensate? –  s_ha_dum Jul 26 '13 at 21:48

Here's what I did:

I simply renamed the wp-admin directory to some obscure name pfgkn for example.

going to http://your-domain.com/wp-admin/ redirects you to your home page at http://your-domain.com/ or whatever else your 404 not found redirects to.

When I need to login - I just rename the pfgkn directory to wp-admin, make my changes and then rename it back to pfgkn.

share|improve this answer
2  
I can't see how this wouldn't break something. –  s_ha_dum Apr 19 '13 at 2:18
    
"or whatever else your 404 not found redirects to" - your 404 Not Found page shouldn't redirect to anything!? –  w3d Nov 9 '13 at 16:03

protected by Community Apr 4 at 7:53

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.