I've successfully made wp-admin not accessible (redirected to 404 page) here is the codes in my function file:

add_filter('site_url', 'wpadmin_filter', 10, 3);

function wpadmin_filter( $url, $path, $orig_scheme ) {
    $old = array( "/(wp-admin)/");
    $admin_dir = WP_ADMIN_DIR;
    $new = array($admin_dir);
    return preg_replace( $old, $new, $url, 1);

function redirect_wp_admin(){
    $redirect_to = $_SERVER['REQUEST_URI'];
    if(count($_REQUEST)> 0 && array_key_exists('redirect_to', $_REQUEST)){
        $redirect_to = $_REQUEST['redirect_to'];
        $check_wp_admin = stristr($redirect_to, 'wp-admin');
            wp_safe_redirect( '404.php' );

and the htaccess:

RewriteRule ^controlpanel/(.*) wp-admin/$1?%{QUERY_STRING} [L]

Now the confusing part is I have no idea how to do the same thing for wp-login.php. the changing from "wp-login.php" to "access" works but when wp-login.php typed, it is still accessible

here's the code in the function file:

add_filter('site_url',  'wplogin_filter', 10, 3);

function wplogin_filter( $url, $path, $orig_scheme )
 $old  = array( "/(wp-login\.php)/");
 $new  = array( "access");
 return preg_replace( $old, $new, $url, 1);

htaccess file:

RewriteRule ^access$ wp-login.php

So, my question is what to do to make wp-login.php not accessible (either redirected to 404 page or anything)?

Any answers are very appreciated :)

Thank you very much in advance

2 Answers 2


Instead of filtering the site_url you should be filtering adim_url and login_url

add_filter('admin_url', 'new_admin_url');

function new_admin_url()
    // Insert the new URL here:
    return get_bloginfo('url').'/controlpanel/';

add_filter( 'login_url', 'new_login_url', 10, 2 );
function new_login_url( $login_url, $redirect ) {
    return get_bloginfo('url').'/access/';

And combine with the Rewrite Rules and redirections in the .htaccess. For example, for the wp-login.php (I'm not a mod_rewrite expert, so it is really possibly the next code doesn't work or need some modifications):

// Internal Rewrite from access to wp-login
RewriteRule ^access(.*)$ wp-login.php$1 [NC,L]

// Real redirection from wp-login to access appending the query string
RewriteCond %{REQUEST_URI} ^wp-login.*
RewriteRule ^ access$ [R=301,NC,QSA,L]
  • Thank you for answering, cybnet :) unfortunately, it still doesn't work :/ blablabla.com/wp-login.php is still accessible :/ what I want is when clients type wp-login.php, they will be redirected to 404 page as my codes above won't allow them to access wp-admin directly before login to blablabla.com/access
    – Wannabe
    Sep 17, 2013 at 13:20
  • As I said in the answer, you have to combine the filters with the Rewrite Rules and redirections in your .htaccess. You could make the redirections using wordpress functions also; here you have to take care to make sure the redirections affect only when trying to access wp-login.php/wp-admin directly via the url and not for the requests form your custom rewrites.
    – cybmeta
    Sep 17, 2013 at 13:53
  • Thank you again, cybnet :) yes your new codes has successfully redirected wp-login.php to 404 page but now blablabla.com/access can't be accessed too haha, I'm sorry I'm a total noob, please bear with me :)
    – Wannabe
    Sep 17, 2013 at 20:35
  • Here's the whole codes I currently have: link if it doesn't bother you, can you please give me the complete solutions both the htaccess and functions file? thank you very very much in advance :)
    – Wannabe
    Sep 17, 2013 at 20:42
  • Th code you have linked is the same you posted in your question.
    – cybmeta
    Sep 17, 2013 at 20:58

You can use the action login_form die just let the page die. This would the most simple and effective thing to do I guess 🤔

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.