Change Login URL Without Plugin

Question

I want to change the login url of my Wordpress install away from /wp-admin.php

I am aiming to do so and am looking at changing the .htaccess file to add in:

RewriteRule ^login$ http://yourdomain.com/wp-login.php [NC, L]

From what I gather however, going to /wp-admin will still allows people to login using that link. I was thinking of doing some sort of PHP redirect so that when the user types in /wp-admin it goes to the 404 not found page.

What is the best way to change the login URL without using a plugin and with the highest security standards?

Answer 1

About changing the login url, i already did by mysel. It help me protect my site and prevent brute force You can change it in htaccess. But you also need to add the filter to replace old login url in wordpress. Example to my website: File .htaccess:

RewriteRule ^signin(.*) wp-login.php?%{QUERY_STRING}

In your theme or custom plugin, you can add the filter to make sure wordpress show the correct login url .

add_filter( 'login_url', 'my_login_page', 10, 2 );
function my_login_page( $login_url, $redirect ) {
    return str_replace("wp-login.php","signin",$login_url);
}

add_action( 'login_form', 'replace_login_submit_form',1); 
function replace_login_submit_form() {
  $your_content = ob_get_contents();
  $your_content = str_replace("wp-login.php","signin",$your_content);  
  ob_get_clean();
  echo $your_content;
}

Hope it can help you!

Answer 2

There is no sane reason or method to do this "without a plugin", because the code necessary to accomplish the job should be contained within a plugin.

Don't roll your own code, use a tried and tested plugin that is designed specifically for the job. That is the secure way.

Answer 3

Add this code in functions.php after that you will not be able to access your page at https://www.thebetacoders.com/wp-admin
Now you will be able to access your page at https://www.thebetacoders.com/wp-login.php?customtext

Change $new_login variables according to your needs.

<?php

function redirect_to_nonexistent_page()
{

  $new_login =  'customtext';
  if (strpos($_SERVER['REQUEST_URI'], $new_login) === false) {
    wp_safe_redirect(home_url('NonExistentPage'), 302);
    exit();
  }
}
add_action('login_head', 'redirect_to_nonexistent_page');

function redirect_to_actual_login()
{

  $new_login =  'customtext';
  if (parse_url($_SERVER['REQUEST_URI'], PHP_URL_QUERY) == $new_login && ($_GET['redirect'] !== false)) {
    wp_safe_redirect(home_url("wp-login.php?$new_login&redirect=false"));
    exit();
  }
}
add_action('init', 'redirect_to_actual_login');

Answer 4

Not sure why anyone is not using the standard WordPress way of doing this.

add_filter( 'login_url', 'my_login_page', 10, 3 );
function my_login_page( $login_url, $redirect, $force_reauth ) {
    return home_url( '/my-login-page/?redirect_to=' . $redirect );
}

The following example would return a login URL http://example.com/my-login-page/ for the wp_login_url() function:

copied from examples of: https://developer.wordpress.org/reference/hooks/login_url/

Answer 5

You can use this code:

add_action('init','custom_login');

function custom_login(){
 global $pagenow;
 if( 'wp-login.php' == $pagenow && $_GET['action']!="logout") {
  wp_redirect('http://YOURSITE.com/URL');
  exit();
 }
}

Answer 6

This can be possible by creating a all new similar file to your existing wp-login.php file. Steps need to follow:

Suggestion: Take a backup of wp-admin.php file before follow the below instruction.

• Open Your wordpress install location, if it is root just look for file called wp-login.php
• Now, create a new php file and name it as your new login url i.e. if you want to make your login url www.yoursite.com/iamgaurav instead of www.yoursite.com/wp-admin, so create the new file named: iamgaurav.php
• Now copy the all codes of existing wp-login.php file & paste it in your new file iamgaurav.php
• Change all existing instances of wp-login to iamgaurav (easy by bulk replacement option through any editor)
• Now save this file and remove the original wp-login.php file from root.

You are done. Clear your cache and check the login with new url: www.yoursite.com/iamgaurav

You will get 404 error in case anyone try to login by www.yoursite.com/wp-admin

Hope it helps.

Thanks