Hiding the WordPress login URL: a complete guide

A complete hide wordpress login url guide covering setup, recovery, and the practical considerations most miss.

3 September 2026

· 8 min read

Hide wordpress login url guide is the practical walkthrough most administrators search for after deciding to harden their site. Hiding works. The implementation has gotchas. This guide covers them in 2026.

Why hiding is the first move

Hiding removes your site from the automated attack queue. Bots cannot brute force a URL they cannot find. The reduction in attack volume is dramatic.

It is the highest leverage single change you can make.

Picking the URL

Random looking strings beat /secret-login. Treat the URL like a password. Use a password manager to store it. Bookmark it on every device.

Common patterns like /backend or /dashboard get probed by bots eventually. Random wins.

Installing the plugin

Install Defyn Security Manager from the WordPress.org repository. Open the settings panel. Pick the URL. Save. The plugin handles the rewrite and the 404 at the old paths.

the Defyn Security Manager plugin also offers redirect or decoy login options at the old URL if you want to mess with bots.

What happens to the old URL

Default is 404. Bots see no WordPress site and move on. You can configure a redirect to your homepage instead, or a decoy login that wastes bot time.

Each option has merit. 404 is the safest default.

Recovery if you forget

Edit wp-config.php to add the disable constant. The plugin disables. Original URLs return. Log in normally and reconfigure. Or rename the plugin folder via SFTP to achieve the same.

Document the recovery in your team wiki.

Frequently asked questions

Does hide wordpress login url guide work for multisite?

Plugin supports single site activation. Multisite on roadmap.

Will hiding break customisations?

Only if your customisation hard codes the old URLs. Update references to the new URL.

Can the URL be guessed?

With sufficiently random strings no. With predictable strings yes.

Is hiding alone enough?

No. Pair with 2FA and brute force lockout.

Why admin login should not be at wp-admin
Login security checklist
Defyn Security Manager on WordPress.org – the plugin powering these techniques.

Claire Smith

Claire Smith is a Sydney-based tech writer covering WordPress, hosting, ecommerce, security, and the practical side of building on the web. She writes for Smart Coding Resources from her desk in Sydney.