Install a login-URL plugin such as WPS Hide Login from Plugins, then Add New, activate it, and type your new login address on the settings page it opens. Bookmark that address straight away, because once it's set the old wp-login.php page and the wp-admin directory stop working, for you as well as for everyone else.
Setting a new login address for the first time
WPS Hide Login moves your login form page to whatever address you choose. First-time setup goes like this.
- In your dashboard, open Plugins, then Add New.
- Search for WPS Hide Login, then download and activate it.
- On the settings page it opens, type your new address.
- Bookmark the new address before you log out.
Then store it in at least two places: your browser bookmarks and your password manager, next to your username. If anyone else logs in to the site, send it to them too, because their saved link stops working the moment you change it.
Before you log out, open the new address in a second browser window and check the login form loads there. It takes a few seconds and confirms the bookmark you've just saved is the right one.
Changing the login address again later
You're not stuck with your first choice. The option can be revisited whenever you like.
- Log in through your current custom address.
- Go to Settings, then WPS Hide Login.
- Type the replacement address and update the setting.
- Replace your old bookmark and tell anyone else who logs in.
It's worth doing if the address has travelled further than you'd like, for example to a freelancer who's finished their work, or to someone who has left the business.
If your site uses a page caching plugin
Caching and a moved login page can clash. According to the plugin's notes, sites running a caching plugin other than WP Rocket should exclude the new login slug from caching.
- Open your caching plugin's settings.
- Find its list of pages it shouldn't cache.
- Add your new login slug and save.
The slug is the part after your domain. If your login page is your domain followed by a word of your choosing, that word is the slug. Change the address later and the exclusion needs updating to the new word as well.
Getting back in after losing the new address
This is the scenario to plan for before it happens. Switching the plugin off returns the site to its previous state, so the default login page answers again.
- Check your bookmarks and password manager first.
- If it's gone, ask whoever manages your hosting or development to deactivate the plugin.
- Log in at the default address once the plugin is off.
- Reactivate it, pick a new address and save it somewhere safe.
A recent copy of the site helps here too. Our guide to backing up a WordPress site covers the routine, so a mistake with any plugin is a quick restore rather than a long afternoon.
Forgotten your password rather than your address? That's a different fix: see resetting your password.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
What the plugin does behind the scenes
Knowing the mechanism explains why the change is so easy to reverse. Nothing in core gets renamed and no rewrite rules are added. The plugin simply intercepts page requests, which is why deactivating it puts everything back as it was.
The catch: easy to lock yourself out, and not a full defence
Two limits matter. The first is the lockout risk. Once the new address is set, wp-admin and wp-login.php are inaccessible, so losing it means no normal login until the plugin is deactivated.
The second is how much protection you get. The WordPress handbook says obscuring the login URL can reduce noise but shouldn't be your only defence. Moving the page cuts down automated traffic hammering the default address. It doesn't replace strong passwords, and our round-up of security plugins is the next stop if you want layers that do more than hide the door.
As of Nov 2026, the login screen is covered in WordPress's official documentation, which is the reference if your install behaves differently.
Frequently asked questions
What should I do before changing the login address?
Take a backup and decide where you'll keep the new address, so one slip doesn't leave you stuck outside.
I'm still logged in but forgot the new address. Where do I find it?
Open Settings, then WPS Hide Login. That's where the address is set, so you can check it there or replace it with one you'll keep.
Should WP Rocket users change anything?
No. The exclusion step is for other caching plugins.
What happens to my saved wp-admin bookmark?
It stops taking you to the login form once the new address is set, because the wp-admin directory becomes inaccessible. Swap it for the new address.
What makes a good new login address?
Something you'll remember but a stranger wouldn't guess. If you run several sites, use a different one on each, so one leak doesn't reveal the door to all of them.
