Change WordPress Login URL

The most common mistake when changing the WordPress login URL is saving the setting and then closing the browser without testing. If the new URL does not work, you could be locked out with no obvious way back in.

The right procedure:

1. After saving the new login URL in your plugin settings, open a new private/incognito window in your browser. This uses a fresh session with no active cookies.
2. Type your new login URL directly into the address bar. Do not click a link. You want to confirm the URL itself works.
3. Enter your credentials and confirm you can log in successfully.
4. Only after you have confirmed access in the incognito window should you consider the change done.

If the new URL shows a 404 or blank page:

• Do not log out of your existing session. Stay logged in while you troubleshoot.
• Go back to Settings > General in your still-active admin session and double-check the saved path.
• Check whether a permalink flush is needed: go to Settings > Permalinks and click Save Changes without changing anything. This refreshes the rewrite rules.
• Deactivate and reactivate the WPS Hide Login plugin to reset its hooks, then try the URL again.

Also bookmark the new URL in your browser and store it in your password manager. The biggest long-term risk is not a brute force attack; it is you or a colleague forgetting the new URL six months from now.

If you have already lost access and cannot reach the login form, you can recover access through three options. None of them require your login URL.

Option 1: Disable the plugin via FTP or SFTP

Deactivating the plugin removes the URL change and restores the standard /wp-login.php path.

1. Connect to your server using an FTP client such as FileZilla, or use your host’s SFTP interface.
2. Navigate to /wp-content/plugins/.
3. Find the folder named wps-hide-login and rename it to anything else, such as wps-hide-login-disabled. WordPress will deactivate it automatically.
4. Visit https://yourdomain.com/wp-login.php. Your standard login page should return.
5. Log in, then rename the plugin folder back to its original name and reactivate it with a corrected URL.

Option 2: Use your hosting control panel file manager

If you do not have FTP credentials, most hosts provide a file manager in cPanel or Plesk. Navigate to the same /wp-content/plugins/ path and rename the plugin folder there. No FTP client required.

Option 3: Disable the plugin via phpMyAdmin

1. Log into phpMyAdmin from your hosting control panel.
2. Open the wp_options table (or with your custom prefix).
3. Search for the row where option_name is active_plugins.
4. Find wps-hide-login in the serialized value and remove the entire plugin reference.
5. Save. The plugin will be deactivated and the standard login URL will be restored.

Whichever method you use, get back in, then re-set the plugin with a URL you have written down somewhere secure before activating it again.

Changing the login URL removes bots that probe the default path, but it is not a complete defense. Once you have the URL changed, add these measures to close the remaining gaps.

Enable two-factor authentication (2FA)

2FA requires a second verification step beyond the password. Even if someone discovers your new login URL and has a valid password (from a data breach, for example), they cannot get in without the second factor. Plugins like WP 2FA or Google Authenticator for WordPress add 2FA to your login form in minutes. For sites with multiple users, this is the most important additional layer you can add.

Limit login attempts

By default, WordPress allows unlimited login attempts. A plugin like Limit Login Attempts Reloaded (free) caps how many times the same IP address can fail to log in before being temporarily blocked. Set the threshold to 3 to 5 attempts, with a lockout period of 15 to 30 minutes. This neutralizes credential-stuffing attacks that use valid username/password combinations from leaked databases.

Add CAPTCHA to the login form

A CAPTCHA on the login page filters out automated submissions without limiting the number of attempts. Simple Login Captcha or the math captcha option in WP Cerber Security are lightweight choices that do not require a Google account or reCAPTCHA API key.

Disable the username hint on login errors

By default, WordPress tells you whether the username or the password was wrong on a failed login. This helps an attacker confirm valid usernames. Add this to your functions.php to return a generic error message instead:

function scanwp_hide_login_errors() {
    return 'Login failed. Please check your credentials.';
}
add_filter('login_errors', 'scanwp_hide_login_errors');