I've successfully made wp-admin not accessible (redirected to 404 page) here is the codes in my function file:

add_filter('site_url', 'wpadmin_filter', 10, 3);

function wpadmin_filter( $url, $path, $orig_scheme ) {
    $old = array( "/(wp-admin)/");
    $admin_dir = WP_ADMIN_DIR;
    $new = array($admin_dir);
    return preg_replace( $old, $new, $url, 1);

function redirect_wp_admin(){
    $redirect_to = $_SERVER['REQUEST_URI'];
    if(count($_REQUEST)> 0 && array_key_exists('redirect_to', $_REQUEST)){
        $redirect_to = $_REQUEST['redirect_to'];
        $check_wp_admin = stristr($redirect_to, 'wp-admin');
            wp_safe_redirect( '404.php' );

and the htaccess:

RewriteRule ^controlpanel/(.*) wp-admin/$1?%{QUERY_STRING} [L]

Now the confusing part is I have no idea how to do the same thing for wp-login.php. the changing from "wp-login.php" to "access" works but when wp-login.php typed, it is still accessible

here's the code in the function file:

add_filter('site_url',  'wplogin_filter', 10, 3);

function wplogin_filter( $url, $path, $orig_scheme )
 $old  = array( "/(wp-login\.php)/");
 $new  = array( "access");
 return preg_replace( $old, $new, $url, 1);

htaccess file:

RewriteRule ^access$ wp-login.php

So, my question is what to do to make wp-login.php not accessible (either redirected to 404 page or anything)?

Any answers are very appreciated :)

Thank you very much in advance


Instead of filtering the site_url you should be filtering adim_url and login_url

add_filter('admin_url', 'new_admin_url');

function new_admin_url()
    // Insert the new URL here:
    return get_bloginfo('url').'/controlpanel/';

add_filter( 'login_url', 'new_login_url', 10, 2 );
function new_login_url( $login_url, $redirect ) {
    return get_bloginfo('url').'/access/';

And combine with the Rewrite Rules and redirections in the .htaccess. For example, for the wp-login.php (I'm not a mod_rewrite expert, so it is really possibly the next code doesn't work or need some modifications):

// Internal Rewrite from access to wp-login
RewriteRule ^access(.*)$ wp-login.php$1 [NC,L]

// Real redirection from wp-login to access appending the query string
RewriteCond %{REQUEST_URI} ^wp-login.*
RewriteRule ^ access$ [R=301,NC,QSA,L]
|improve this answer|||||
  • Thank you for answering, cybnet :) unfortunately, it still doesn't work :/ blablabla.com/wp-login.php is still accessible :/ what I want is when clients type wp-login.php, they will be redirected to 404 page as my codes above won't allow them to access wp-admin directly before login to blablabla.com/access – Wannabe Sep 17 '13 at 13:20
  • As I said in the answer, you have to combine the filters with the Rewrite Rules and redirections in your .htaccess. You could make the redirections using wordpress functions also; here you have to take care to make sure the redirections affect only when trying to access wp-login.php/wp-admin directly via the url and not for the requests form your custom rewrites. – cybmeta Sep 17 '13 at 13:53
  • Thank you again, cybnet :) yes your new codes has successfully redirected wp-login.php to 404 page but now blablabla.com/access can't be accessed too haha, I'm sorry I'm a total noob, please bear with me :) – Wannabe Sep 17 '13 at 20:35
  • Here's the whole codes I currently have: link if it doesn't bother you, can you please give me the complete solutions both the htaccess and functions file? thank you very very much in advance :) – Wannabe Sep 17 '13 at 20:42
  • Th code you have linked is the same you posted in your question. – cybmeta Sep 17 '13 at 20:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.