Attack-surface notes · Intermediate · 15 minutes
How to hide the WordPress login page — Moving wp-login Buys Quiet, Not Safety
Bots are hammering wp-login.php around the clock, and you want to know whether moving it helps the server or only helps the log file.
The short answer
Moving the login URL is a traffic and log-hygiene measure, not a security control: automated scanners hit wp-login.php constantly, and each attempt is a PHP request your account pays for in workers and CPU. Rename the path and that noise mostly stops, which is a real and measurable saving on a busy shared account.
It does not make you harder to attack by anyone who has bothered to look at your site. Two-factor authentication and a cap on failed attempts are what actually protect the account — the moved address just thins the crowd at the door.
By the HostingFast team · Reviewed 24 August 2026
Intermediate
Assumed skill
15 minutes
Time at the keyboard
5
Stages in the runbook
24/7
Engineers on shift
This is written as an honest cost-benefit rather than a security tip. There is a genuine benefit, it is measurable, and it is not the benefit most articles claim.
Before and after readings make the case in about two minutes: count the requests to wp-login.php in your access log for a day, apply the change, then count again a day later.
What you are actually buying
Every hit on wp-login.php boots WordPress, runs PHP and touches the database, whether the credentials are plausible or not. On an account with a modest worker pool, a sustained scan competes with real visitors for the same processes, and that shows up as slower responses at exactly the wrong moment.
Renaming the login path means those requests hit a 404 that never loads WordPress at all. The logs get readable, the worker pool stops being nibbled, and any failed-login alerting you have starts reporting signal rather than weather.
Measure the noise, before and after
`grep -c 'wp-login.php' access_log` on a day's log gives you the baseline in one command. On a site that has been online a year or two, four-figure daily counts are ordinary and five-figure ones are not unusual.
Run the same count a day after the change. That difference is the entire honest case for doing this, and it is far more persuasive than the security claim — you can put a number on the requests you stopped serving.
The defences that do the real work
Two-factor authentication makes a stolen or guessed password worthless. A limit on failed attempts stops credential stuffing regardless of which URL the form sits behind. Strong unique passwords from a manager remove the guessing attack entirely. Those three are the door; the renamed path is the queue outside it.
Check the other entrances while you are here. Confirm wp-admin redirects sensibly rather than exposing the form again, and that any WooCommerce or membership login pages — which live on their own URLs — still behave as they did before.
Your way back in when the plugin misbehaves
If the login plugin breaks or conflicts after an update, renaming its folder in wp-content/plugins from File Manager restores the standard URLs immediately. Knowing that in advance is what makes this a low-risk change rather than a way to lock yourself out of your own site.
Record the custom path somewhere other than the site it protects — a password manager entry, not a note in the site's own admin. And write down the recovery method next to it, because the moment you need it is the moment you will not be thinking clearly.
Where the access log is yours to read
Every runbook here was exercised on the platform we actually operate — cPanel, LiteSpeed, NVMe storage, one-click installs — so the log paths and panel screens match yours rather than a generic host's.
Support is a human being at any hour, and the scope covers the awkward practical questions other hosts bounce straight back to you.
- Raw access logs available from the control panel
- DDoS filtering absorbed out at the network edge
- Daily backups, with self-service restores you run from the panel
- Human support on duty every hour of every day
Why HostingFast
Standard on every plan
Honest about what it does
The benefit is fewer PHP requests and a readable log. It is not a substitute for authentication, and the page says so.
Measured, not asserted
One grep gives you the before figure and one gives you the after, so the change has a number attached.
The worker pool argument
Every login attempt boots WordPress and competes with real visitors — which is why this is a performance change too.
Other entrances checked
wp-admin, WooCommerce and membership login pages all get verified, because they live on separate URLs.
A recovery route written first
Renaming the plugin folder restores the defaults, and you know that before you need it.
Scoped honestly
Moving the login path is an intermediate job — about 15 minutes, including the before-and-after count.
Quick Start
From order to online
- 1
Count the noise first
`grep -c 'wp-login.php' access_log` over a day of logs. That figure is your baseline, and it is also the entire justification for the change.
- 2
Install a login-URL plugin and set the path
A login-rename plugin serves the form at yourdomain.com/your-chosen-path and returns 404 on the defaults, so the standard URL never boots WordPress at all.
- 3
Store the path off the site
Record the new URL in a password manager, not in a note inside the admin you have just made harder to reach. Store the recovery method beside it.
- 4
Add the defences that actually matter
Two-factor authentication and a cap on failed attempts. The renamed path thins the traffic at the door; these two are what the door is made of.
- 5
Check the other entrances, then recount
Confirm wp-admin redirects sensibly and that store or membership login forms still work. A day later, run the same grep and compare — that delta is your result.
Built In
Loaded onto every plan
- Raw access logs available from the control panel
- DDoS filtering absorbed out at the network edge
- Daily backups, with self-service restores you run from the panel
- Free SSL on every plan, renewed automatically before it can expire
- Per-site PHP version switching from the control panel
- LiteSpeed caching built into the server rather than patched in by plugin
- Staging environments for testing changes before they ship
- cPanel — the control panel most of the industry already runs
- Human support on duty every hour of every day
- In-place account upgrades — no migration when you change plan
Frequently Asked
What people ask us most often
Does moving the login URL reduce server load in a way I can measure?
Yes, and that is the strongest argument for it. Each hit on wp-login.php boots WordPress, uses a PHP worker and queries the database. Count the requests in your access log before and after: on a site that has been up a couple of years, stopping several thousand PHP invocations a day is a genuine saving on a shared worker pool.
Is a renamed login path any defence against a targeted attacker?
No. Anyone specifically interested in your site will find the form — through a plugin's redirect, an exposed REST route, or simply by watching where a login redirects to. It filters drive-by scanners, which are most of the volume. Treat it as noise reduction and put your actual trust in two-factor and rate limiting.
Who is behind HostingFast?
HostingFast is a trading name of Vitalcare at Home Ltd, registered in England and Wales — a real company with a public record and terms governed by English law. Running that check on any host before you hand over a domain is time well spent.
Does hosting include mailboxes on my own domain?
Yes — every plan includes mailboxes on your domain, with webmail, IMAP, POP and SMTP plus spam filtering on from the start. There is also standalone email hosting for a domain whose website lives somewhere else entirely.
Keep reading
How to Block Unwanted Visitors by IP
Refuse a persistent source at the perimeter, with a clear view of what IP blocking can and cannot do — intermediate, about 10 minutes.
How to Upload Files With File Manager
Move files into your document root from a browser tab, with no FTP client involved — beginner, roughly 10 minutes.
Best WordPress.com vs Self-Hosted WordPress
Weighed on the numbers that differ: build model, plugin ecosystem, and what each does to page weight.
Reseller Hosting
White-label WHM hosting — your brand out front, monthly billing behind it.
WHMCS License
Automate billing, provisioning and support for your own hosting clients.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Stop paying workers for bot traffic.
DDoS filtering at the network edge, raw access logs in the panel, LiteSpeed caching and daily backups — with support that answers at any hour.
View Reseller Hosting plans