How can I rename the WordPress AJAX URL? [duplicate]

Question

I'm currently looking for a way to change / hide the default WordPress admin-ajax.php URL. I want to do this to remove the admin from it to prevent misunderstandings by my customers when I use the AJAX URL to read for example a file from my server. In this case, the URL has the admin prefix which is a bit confusing.

So in result the AJAX URl should looks like this: ajax.php

I've searched a bit but I can't find any helpful informations. Because of this I can't show you any related code. But when I got it, I'll update my question to help other people.

Maybe there is someone who did this before and can give me some helpful tips so that I can implement this asap? This would be very awesome!

Answer 1

It's not as hard to solve as one might think... If only all plugins/themes respect best practices.

If they do, then all links to admin-ajax.php are generated with admin_url function. And this function has a hook inside, so we can modify the url it returns:

// This will change the url for admin-ajax.php to /ajax/
function modify_adminy_url_for_ajax( $url, $path, $blog_id ) {
    if ( 'admin-ajax.php' == $path ) {
        $url = site_url('/ajax/');
    }

    return $url;
}
add_filter( 'admin_url', 'modify_adminy_url_for_ajax', 10, 3 );

So now we have to teach WordPress to process such requests. And we can use .htaccess to do so. This line should do the trick:

RewriteRule ^/?ajax/?$ /wp-admin/admin-ajax.php?&%{QUERY_STRING} [L,QSA]

So now, all the AJAX requests should be visible as /ajax/ and not as wp-admin/admin-ajax.php

Answer 2

The googles got me to this place, which does it with a plugin. https://github.com/devgeniem/wp-no-admin-ajax

Since it is open source, you might look at how they do it. Or just use the plugin.

No experience with it. "Security by obscurity" is not one of my things to do. But their process may work for you. If you are planning on copying the file elsewhere, be aware you may need to re-copy after WP updates.

Added: I like Krzysiek Dróżdż's answer, though.