What I'm trying to do

  1. Changing the login-URL from https://example.org/wp-login to https://example.org/mellon
  2. Making https://example.org/wp-login redirect to the 404-page.


If I Google it, then I find a couple of suggestions, where /wp-admin/wp-login.php is renamed/changed. Which obviously is a terrible idea (reasons: Never change core! + It will reset upon updating WordPress).

I'm currently using WP Cerber which has it as an option to change the login-URL. But for some reason, then the option doesn't work.

I know that can most likely find a plugin that does this. But I hate installing plugins for simple things, to avoid having a bazillion plugins.

I would prefer not to do it in the .htaccess-file, since I don't commit that to my code-respository.

Can it be done from functions.php?

2 Answers 2


You should change the login url from default than it'll hard for hackers to find the login page so it'll be safe for you.

Here is the code to change the url.

// Add rewrite rule and flush on plugin activation
register_activation_hook( __FILE__, 'NLURL_activate' );
function NLURL_activate() {

// Flush on plugin deactivation
register_deactivation_hook( __FILE__, 'NLURL_deactivate' );
function NLURL_deactivate() {

// Create new rewrite rule
add_action( 'init', 'NLURL_rewrite' );
function NLURL_rewrite() {
    add_rewrite_rule( 'login/?$', 'wp-login.php', 'top' );
    add_rewrite_rule( 'register/?$', 'wp-login.php?action=register', 'top' );
    add_rewrite_rule( 'forgot/?$', 'wp-login.php?action=lostpassword', 'top' );

//register url fix
function fix_register_url($link){
    return str_replace(site_url('wp-login.php?action=register', 'login'),site_url('register', 'login'),$link);

//login url fix
function fix_login_url($link){
    return str_replace(site_url('wp-login.php', 'login'),site_url('login', 'login'),$link);

//forgot password url fix
function fix_lostpass_url($link){
    return str_replace('?action=lostpassword','',str_replace(network_site_url('wp-login.php', 'login'),site_url('forgot', 'login'),$link));

//Site URL hack to overwrite register url
function fix_urls($url, $path, $orig_scheme){
    if ($orig_scheme !== 'login')
        return $url;
    if ($path == 'wp-login.php?action=register')
        return site_url('register', 'login');

    return $url;

It is not a good idea to change your login url without a plugin, because you will need to have to mess around with WP core files. So changing the login url is not a "simple thing" as you call it, but pretty complex.

I guess there is a reason WP shows you a way to create a new login form, but does not tell you how to change it completely. If you are interested: https://codex.wordpress.org/Customizing_the_Login_Form#Make_a_Custom_Login_Page

Using a plugin is the safer way to change the login url of wordpress.

So there is a great plugin for this: https://wordpress.org/plugins/wps-hide-login/

It is very lightweight and does the one and only thing you want: Hide the wp-login and wp-admin and use a name you choose. Not bloating your installation with unneeded things, but doing a good job for the one use it was made for.

Go to Settings -> Gerneral, or alternatively to Settings -> WPS Hide Login to change the login url.

It is important that you remember your new url or set a bookmark, otherwise you will not be able to find your new login page.

I know you wanted a solution for your functions.php. I don't think there is one, and I also would recommend to use a plugin because it will solve the issue in a better and safer way.

  • Thanks for weighing in. But I was hoping for a functions.php. And once I have that, then I could better determine if WPS Hide Login is the way to go or not. And it must exist. Because it is what's in the belly of the plugin you suggest.
    – Zeth
    May 17, 2020 at 8:36
  • I've just looked at the code for WPS Hide Login. There are 650 lines of code. And it's also dealing with multi-sites. But I can't really figure, how it's put together. :-/
    – Zeth
    May 17, 2020 at 9:00
  • Word of warning about the statements here.... (1) If a plugin can change the login URL, then you do not have to change core files without a plugin. If a plugin can do it, so can your own code, and (2) Somebody else's plugin is not the safest way to do it. Its someone else's code, you have no idea of the quality, updates to it could introduce bugs and other issues. Plugins need to be used with caution. The safest way is using your own code in functions.php (or your web developer if you dont know PHP) so you do not introduce untested and autoupdated code from someone else. Dec 31, 2020 at 10:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.