{"id":3017,"date":"2020-02-23T14:40:29","date_gmt":"2020-02-23T08:40:29","guid":{"rendered":"https:\/\/codexpert.io\/?p=3017"},"modified":"2024-03-13T11:08:44","modified_gmt":"2024-03-13T05:08:44","slug":"hide-your-wordpress-login-page-from-hackers","status":"publish","type":"post","link":"https:\/\/codexpert.io\/blog\/hide-your-wordpress-login-page-from-hackers\/","title":{"rendered":"Hide Your WordPress Login Page From Hackers"},"content":{"rendered":"<div class='cx-content-before'><\/div><p><span style=\"font-weight: 400;\">WordPress login page is like a key which gives admin users access to the dashboard, so as part of our strategy of creating \u2018security through obscurity,\u2019 let\u2019s hide your login page URL from everyone else but the admin.<\/span><\/p>\n<h3 id=\"cx-heading-1\"><strong>Optional Step: Install WordPress In Its Own Directory<\/strong><\/h3>\n<p><span style=\"font-weight: 400;\">Whether you\u2019re dealing with a brand new WordPress installation or an existing WordPress website, whenever possible consider installing WordPress in a subdirectory. While this won\u2019t prevent hackers from finding your WordPress login page if they deliberately choose to target your site, it will discourage many random bots and malicious users looking for easy targets to start hitting up your site and shaking your tree to see what falls out.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Having your WordPress site installed in a subdirectory, then, is a good first step toward creating \u2018security through obscurity.\u2019<\/span><\/p>\n<p><span style=\"font-weight: 400;\">As always, before you do anything else, as always, if you\u2019re moving an existing WordPress installation, create a complete backup of your site and store it someplace where you won\u2019t accidentally delete or modify it.<\/span><span style=\"font-weight: 400;\">predictable<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Whether you choose to install WordPress in a subdirectory or not as an added security precaution is up to you.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The next step is to hide your login page URL and optionally redirect wp-login.php visitors to another page on your site.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">There are a few ways you can hide your WP login page from other users:<\/span><\/p>\n<ul>\n<li><span style=\"font-weight: 400;\">Use a plugin to mask your login URL (easiest way)<\/span><\/li>\n<li><span style=\"font-weight: 400;\">Mask your WordPress login URL without a plugin.<\/span><\/li>\n<li>Modify your .htaccess file.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-5665 aligncenter\" src=\"https:\/\/codexpert.io\/wp-content\/uploads\/2020\/02\/login-page-scaled.jpg\" alt=\"login page\" width=\"770\" height=\"513\" srcset=\"https:\/\/codexpert.io\/blog\/wp-content\/uploads\/2020\/02\/login-page-scaled.jpg 2560w, https:\/\/codexpert.io\/blog\/wp-content\/uploads\/2020\/02\/login-page-scaled-300x200.jpg 300w, https:\/\/codexpert.io\/blog\/wp-content\/uploads\/2020\/02\/login-page-scaled-1024x683.jpg 1024w, https:\/\/codexpert.io\/blog\/wp-content\/uploads\/2020\/02\/login-page-scaled-768x512.jpg 768w\" sizes=\"auto, (max-width: 770px) 100vw, 770px\" \/><\/p>\n<h3 id=\"cx-heading-2\"><strong>Hide Your Site Login Page<\/strong><\/h3>\n<p>Before we get started, the strategy shared below isn\u2019t recommended if your site requires a login page that needs to remain easy for other users to find (like a membership site).<\/p>\n<p>If your site is not a membership site and login attempts are limited to a dozen or fewer admins, authors, editors, and contributors, then hiding your login page will help protect your site against malicious login attempts.<\/p>\n<p>&nbsp;<\/p>\n<h3 id=\"cx-heading-3\"><strong>Hide wp-login.php Using a Plugin<\/strong><\/h3>\n<p>There are a number of free WordPress plugins that will let you hide the login page URL. Some of these plugins will also let you redirect wp-login.php visitors to another page of your website. Just visit the WordPress.org plugins directory and search for \u201cHide WP Login\u201d to see a list of security plugins that you can use.<\/p>\n<p>&nbsp;<\/p>\n<h3 id=\"cx-heading-4\">Hide WordPress Login Page Without A Plugin<\/h3>\n<p>If you want to hide your login page without using a plugin, all you need is a text editor, access to your WordPress installation files (FTP, cPanel File Manager, etc), and then do the following:<\/p>\n<p><strong>1. Make a backup of your wp-login.php file.<\/strong><\/p>\n<p>While you are at it, go ahead and make a backup of everything else too, as you\u2019re about to mess with code and enter the danger zone!<\/p>\n<p><strong>2. Create a new PHP login file.\u00a0<\/strong><\/p>\n<p>Create a new file using your text editor. Call this file anything you like (e.g. \u2018canny-login.php\u2019, \u2018danger-zone.php\u2019 etc.).<\/p>\n<p>Paste the code from your existing wp-login.php file into your new file and save.\u00a0Alternatively, open your wp-login.php file and \u2018save as\u2019 your new filename.<\/p>\n<p><strong>3. Search and replace the \u2018wp-login.php\u2019 string in your new file code.<\/strong><\/p>\n<p>Search and replace every instance of \u2018wp-login.php\u2019 in the code with your new login filename.<\/p>\n<p>Resave the file with the modified code.<\/p>\n<p><strong>4. Upload your new login file to your server.<\/strong><\/p>\n<p>Log into your server and upload the new login file to the root folder or directory where you have installed WordPress.\u00a0Delete the original\u00a0<em>wp-login.php<\/em>\u00a0file from your server.<\/p>\n<p><strong>5. Test your new login URL<\/strong><\/p>\n<p>All that\u2019s left to do now is test your new login page URL. Anyone visiting the default wp-login.php page will experience an error.<\/p>\n<p>To revert to the original login page, simply restore the wp-login.php file from your backup and delete the new file from your server.<\/p>\n<p>&nbsp;<\/p>\n<h3 id=\"cx-heading-5\"><strong>WordPress Login URL .htaccess File Hacks<\/strong><\/h3>\n<p>There are ways to \u2018obscure\u2019 your WordPress login details using the .htaccess file. Obscuring your WordPress login URL, however, doesn\u2019t necessarily mean hiding it from others.<\/p>\n<p>For example, let\u2019s take a look at what happens when you add URL forwarding to your .htaccess.\u00a0Remember to\u00a0make a complete backup of your site\u00a0before making any changes to your .htaccess file.<\/p>\n<p>&nbsp;<\/p>\n<h3 id=\"cx-heading-6\"><strong>WordPress Login Page Obscurity With URL Redirection<\/strong><\/h3>\n<p>You can change the location of your login page by changing the name of your WordPress login file using the\u00a0mod_rewrite module\u00a0in an Apache server.<\/p>\n<p>To do this, add the line below to your .htaccess file (note: replace \u2018newloginpage\u2019 with any alias and change the\u00a0<em>example.com<\/em>\u00a0URL to your domain):<\/p>\n<p><code>RewriteRule ^newloginpage$  [NC,L]<\/code><\/p>\n<p>In this example, we\u2019ll add an alias and reupload the .htaccess file to your server.<\/p>\n<p>As you can see, the above method doesn\u2019t\u00a0<em>hide<\/em>\u00a0the default WordPress login URL, it merely creates an\u00a0<em>alias<\/em>\u00a0that lets users log into their WordPress dashboard using a web address that is easier for them to remember than\u00a0<code>https:\/\/yourexample.com\/wp-login.php<\/code>.<\/p>\n<p>&nbsp;<\/p>\n<h3 id=\"cx-heading-7\"><strong>Hide Your WordPress Login Page With Code<\/strong><\/h3>\n<p>Ideally, we recommend just sticking to using a plugin if you want to change your WordPress login URL, hide the wp-admin wp-login.php pages, or redirect users away from the default login page. Messing with code can cause compatibility issues, slow down your site, and create other problems.<\/p>\n<p>Read our other posts from <a href=\"https:\/\/codexpert.io\/blog\/\">here<\/a>.<\/p>\n<div class='cx-content-after'><\/div>","protected":false},"excerpt":{"rendered":"<p>WordPress login page is like a key which gives admin users access to the dashboard, so as part of our strategy of creating \u2018security through obscurity,\u2019 let\u2019s hide your login page URL from everyone else but the admin. Optional Step: Install WordPress In Its Own Directory Whether you\u2019re dealing with a brand new WordPress installation [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":3863,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[195],"tags":[352],"class_list":["post-3017","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-general"],"_links":{"self":[{"href":"https:\/\/codexpert.io\/blog\/wp-json\/wp\/v2\/posts\/3017","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/codexpert.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/codexpert.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/codexpert.io\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/codexpert.io\/blog\/wp-json\/wp\/v2\/comments?post=3017"}],"version-history":[{"count":1,"href":"https:\/\/codexpert.io\/blog\/wp-json\/wp\/v2\/posts\/3017\/revisions"}],"predecessor-version":[{"id":25653,"href":"https:\/\/codexpert.io\/blog\/wp-json\/wp\/v2\/posts\/3017\/revisions\/25653"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/codexpert.io\/blog\/wp-json\/wp\/v2\/media\/3863"}],"wp:attachment":[{"href":"https:\/\/codexpert.io\/blog\/wp-json\/wp\/v2\/media?parent=3017"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/codexpert.io\/blog\/wp-json\/wp\/v2\/categories?post=3017"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/codexpert.io\/blog\/wp-json\/wp\/v2\/tags?post=3017"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}