Custom Login URL documentation
Give your login page its own address and send anyone who tries /wp-admin or wp-login.php somewhere else. Bots that only know the default URL never reach the form.
Overview
Every WordPress site has its login at the same two addresses, so automated attacks don’t need to look for it. They go straight to wp-login.php.
Moving the login doesn’t replace strong passwords, but it removes most of the automated traffic in one step.
Plan: Free. Everything on this page is in the free plugin.
Setup
- Turn on Custom Login URL under Security & Privacy.
- Enter the new login slug and bookmark the full address.
- Choose where visitors trying /wp-admin are sent, then save.
Settings
| Setting | What it does | Plan |
|---|---|---|
| Custom Login URL Slug | Enter the new slug for the login page. | Free |
| Redirect Type | Select where the user is redirected if accessing wp-admin directly. | Free |
| Existing Page | Select an existing page to redirect to. | Free |
| Access Denied Message | The message displayed to the user if they cannot access the page. | Free |
Questions and troubleshooting
Is Custom Login URL free?
Yes. It is included in the free WordPress.org plugin.
What if I forget my new login address?
Deactivate WP Extended by renaming its folder over FTP or your host’s file manager. The default wp-login.php address comes back straight away.
Does it replace a security plugin?
No. It cuts automated login traffic. Use it with Limit Login Attempts and strong passwords.
Do password-protected pages still work?
Yes. WordPress’s page password form posts to wp-login.php, and Custom Login URL lets those submissions through while still blocking the login screen.
It isn’t working as expected
Check the module is switched on and its settings are saved. If another plugin does the same job, deactivate one of them. Then clear any page cache and test again. Still stuck? Pro customers can contact support; free users can post on the WordPress.org forum.