1

I changed the admin URL from /wp-admin like this:

  • rename wp-login.php to mylogin.php
  • replace all occurrences of wp-login.php with mylogin.php

Now I can login via /mylogin.php.

The default page can be accessed without the extension at /wp-admin rather than /wp-admin.php.

How can I do the same so I can login via /mylogin instead of /mylogin.php?

(I'd like to do this without a plugin.)

11
  • 1
    If you're doing this for security reasons, then you are no safer than you previously were. You'll have also broken some functionality such as expired login modal dialogs and redirects. If you fix that, it can still all be undone by using the built in permalink /login that redirects to the login page. You'll also have broken some poorly built plugins and themes that depend on wp-admin for admin AJAX endpoints ( and those that work properly will reveal its location anyway ). If it's a custom login page you wanted though, there are alternatives
    – Tom J Nowell
    Nov 25 '19 at 19:11
  • Tom is correct you should never do this! not only for the above reason but when you upgrade your WordPress version it could install the wp-login.php file in future version. Use a plugin like wordpress.org/plugins/wps-hide-login as this will do the work via non intrusive means and give you more control.
    – Sam
    Nov 25 '19 at 22:09
  • @TomJNowell Very interesting! Assuming I'm the only one that logs into the admin area, is it still a risk? I didn't realize plugins need access to that endpoint - why do they behave that way?
    – lonix
    Nov 26 '19 at 7:37
  • It is not worth investing time into hiding or moving the Admin or login for security as it doesn't actually improve the security. Hiding your login is "security via obscurity", which does not improve security. If you want to secure your login, use strong passwords ( 14 or more characters ), add a 2FA plugin, and add rate limiting via something like limit login attempts so bad actors get locked out after 2 or 3 tries
    – Tom J Nowell
    Nov 27 '19 at 23:06
  • 1
    That's not true, bots don't check if your site is running WordPress, they just fire the HTTP request and forget. Afterall why waste the processor cycles waiting for a network reply to ident the CMS when you can fire off every exploit you have asynchronously at the same time? If you look carefully you'll even see attempts to login to Drupal and Joomla even though they're not on your server. If you have server level access, I'd consider adding sever level rate limiting so that if failed attempts happen the sender is blocked at a lower layer and never gets to interact with Nginx
    – Tom J Nowell
    Nov 28 '19 at 16:08
0

Change wp-admin login is a light plugin that allows you easily and safely to change wp-admin to anything you want. It does not rename or change files in core. It simply intercepts page requests and works on any WordPress website. After you activate this plugin the wp-admin directory and wp-login.php page will become unavailable, so you should bookmark or remember the url. Disable this plugin brings your site back exactly to the state it was before.

Go under Settings and then click on “Permalinks” and change your URL under “Change wp-admin login”.

Example: http://www.example.com/my-login.

  1. Go to Plugins › Add New.
  2. Search for Change wp-admin login.
  3. Download and activate it.
  4. Go under Settings and then click on “Permalinks” and change your URL under “Change wp-admin login”
  5. You can change this anytime, just go back to Settings › Permalinks › Change wp-admin login.
1
  • 1
    This is just a plugin recommendation, it doesn't explain how to actually do what the OP is asking. Perhaps if your answer explained how the plugin performed the technical feat the OP asks about?
    – Tom J Nowell
    Dec 1 '19 at 0:32
0

For change Login Page URL you can use "https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/" plugin.

With the help of this plugin you can change login page URL like: http://www.yoursite.com/newurl

1
  • This is just a plugin recommendation, it doesn't explain how to actually do what the OP is asking. Perhaps if your answer explained how the plugin performed the technical feat the OP asks about?
    – Tom J Nowell
    Dec 1 '19 at 0:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.