What if my license expires or becomes invalid?

If the license is invalid or deactivated, Change Login URL stops loading and the default login paths are exposed again. An admin notice warns you so you can renew or disable the module. Calendar expiry of a previously activated license alone does not remove access while entitlement remains valid.

Change Login URL

Summarize with AI

Change Login URL is a WP PowerSuite Pro module that moves the WordPress sign-in screen to a private path you choose. Bots that hammer wp-login.php get a 404 (or your redirect) instead of a login form — bookmark the new address so you never lock yourself out.

No extra single-purpose plugin. Enable it from the Modules hub when a site needs a quieter login door; leave it off when you do not. Product overview: Change Login URL.

Why teams choose it

Default WordPress login URLs are public knowledge. Automated scanners probe wp-login.php and logged-out wp-admin constantly. Change Login URL lets agencies and site owners:

Serve login only at a private slug (for example /your-site-crew)
Return 404 (or redirect) on default login paths so probes get nothing useful
Keep logout, password reset, and registration links pointed at the custom URL
Brand the same private URL with Login Page Customizer
Stay WooCommerce-aware so storefront password resets do not surprise customers

All of that lives inside WP PowerSuite — one license, one update cycle, enable only what you need.

Hide the default login without another plugin

Change Login URL is included with WP PowerSuite Pro. Explore plans and unlock the full module library.

View pricing

Who it is for

Agencies that want a non-obvious sign-in path per client site
Public sites tired of bot noise on wp-login.php
WooCommerce stores that still want customer resets on My Account by default
Teams pairing a private URL with login branding and 2FA
Multisite networks that apply one network-wide login slug

What you can do

Pick (or auto-generate) a private login slug — uncommon phrases beat words like login or admin
Sign in at https://your-site.com/{slug} with the full WordPress login screen
Block wp-login.php, logged-out wp-admin, and common aliases (/login, /admin, and similar)
Choose 404 (recommended) or redirect when someone hits a blocked URL
Rely on automatic rewriting of login, logout, lost-password, register, and same-site redirect links
Keep password reset emails and new-user emails pointing at the private URL
Use Advanced options for legacy wp-login.php?action=… redirects, password URL mode, and WooCommerce extras
Copy the live login URL from Settings with one click
Work with other PowerSuite login modules (CAPTCHA, Login Page Customizer, 2FA) on the same private path

Important: bookmark your new URL

If you lose the URL and still have filesystem or WP-CLI access, disable the module (or temporarily rename the plugin folder), sign in at wp-login.php, then re-enable carefully and bookmark again. See Troubleshooting below.

Settings

Open the module’s Settings (gear icon) under WP PowerSuite → Modules → Change Login URL.

Standard

Setting	Purpose	Default
Login slug	Path after your site home. Lowercase letters, numbers, and hyphens only. Must not conflict with pages, posts, or reserved paths.	Empty until enable — then a unique `access-…` slug is created automatically

Your sign-in URL becomes https://your-site.com/{login_slug}. Use Copy next to the preview to grab it quickly.

Advanced options

Leave these alone for most sites. Safer defaults are already set.

Setting	Purpose	Default
Blocked URLs	What happens on `wp-login.php` / logged-out `wp-admin`: show 404 or Redirect to a URL	404
Redirect URL	Destination when Redirect is selected (optional — defaults to homepage). Same-site / validated only.	Empty → homepage
Legacy links	Redirect reset / logout / register style `wp-login.php?action=…` links to your custom URL. Can reveal the private slug to anyone probing those legacy URLs — leave off unless you need that compatibility.	Off
Password reset URLs	Auto (WooCommerce My Account on the storefront, custom login elsewhere), Always custom login URL, or Always WooCommerce My Account	Auto if WooCommerce is active, otherwise Always custom
Redirect guest My Account login (WooCommerce)	Send guests from the My Account login form to your custom login URL, then back after sign-in. Password endpoints with a key are not redirected.	Off
Rewrite links in WooCommerce emails (WooCommerce)	Put the custom login/reset URL into customer emails. Can expose your private slug in every reset/new-account email — leave off for better obscurity; My Account lost-password links still work.	Off

Many sites solve “hide wp-login.php” with yet another plugin — more updates, more overlap, more risk. With WP PowerSuite you get Change Login URL as a modular Pro capability alongside 150+ other tools: enable it for client hardening, disable it when a site does not need it, and keep everything under WP PowerSuite Pro.

Learn more on the module page, browse all modules, or compare plans and pricing.

When to enable it

Turn it on when you want to:

Reduce bot noise on the default WordPress login path
Give each client site a private, bookmarked sign-in address
Pair a custom path with Login Page Customizer branding
Keep storefront password resets friendly while still masking admin login

When to leave it off

How to get started

Activate your WP PowerSuite license under WP PowerSuite → License.
Go to WP PowerSuite → Modules, filter Login & Users, and enable Change Login URL.
Open Settings. A unique access-… slug is created automatically if the field was empty — or enter your own uncommon phrase.
Copy and bookmark the login URL immediately.
Leave Advanced options at their defaults unless you need a redirect or WooCommerce tweak.
Click Save, then open the new URL in a private/incognito window and confirm you can sign in.

To undo it, toggle the module off — wp-login.php works again.

How to verify it works

Visit https://your-site.com/your-slug while logged out.
✅ The WordPress login form loads.
Visit https://your-site.com/wp-login.php while logged out.
✅ You get a 404 (or your chosen redirect) — not the login form.
Visit https://your-site.com/wp-admin/ while logged out.
✅ Same blocked behavior as above.
Sign in via the custom URL, then log out from the dashboard.
✅ Logout flows through the custom path (and you can sign in again from the interstitial if shown).
(WooCommerce, defaults) Request a customer password reset from My Account.
✅ Reset stays on the storefront My Account flow unless you changed Advanced password mode.

If something fails, confirm the license is active, the module is still enabled, and you saved Settings successfully. Clear page cache / CDN if an old response is stuck.

WooCommerce notes

With WooCommerce active and defaults unchanged:

Password reset URLs use Auto — customers stay on My Account; admin/other contexts use the custom login URL
Guest My Account redirect is off — shoppers still see the My Account login form
Email rewrite is off — customer emails keep My Account lost-password links (better obscurity)

Turn Advanced WooCommerce options on only when you intentionally want guests funneled through the private login URL or custom links inside emails.

License and recovery notes

Pro module — needs a valid WP PowerSuite license to load and protect the login path.
If the module is enabled but the license becomes invalid / deactivated, protection stops and default login URLs are exposed again. Admins see a notice with a link to activate the license.
Calendar expiry of a previously activated license alone does not remove access while your entitlement remains valid; renew when prompted so updates and support stay current.
Losing admin access: disable the module via WP-CLI / database / temporarily renaming the plugin folder, sign in at wp-login.php, then re-enable and bookmark.

Troubleshooting

404 on the custom slug. Confirm the module is on, the license is valid, and the slug was saved. Clear caches/CDN. If you reused an old slug, save Settings once more.
Still see the login form at wp-login.php. License inactive, module off, or another plugin restoring the default URL. Check the admin license notice.
Locked out. Use filesystem/WP-CLI access to disable the module or rename the plugin folder temporarily, sign in at wp-login.php, then re-enable carefully and bookmark. See also Troubleshooting basics.
Slug rejected on save. Use only lowercase letters, numbers, and hyphens. Avoid reserved paths (wp-admin, wp-login, login, admin, my-account, cart, and similar) and any slug that matches an existing page, post, or term.
Password reset says invalid key. Sign in and reset only through the custom login URL (or WooCommerce My Account when Auto/Woo mode applies). Clear cache on the login path.
WooCommerce customers confused after you turned on email rewrite. Turn Rewrite links in WooCommerce emails off, or switch password mode away from Always custom, then save.
Another plugin also changes the login URL. Disable one of the two remappers — do not run both.

Manage with WP-CLI

Prefer the command line? You can turn this module on or off with WP-CLI instead of the dashboard:

# Turn the module on
wp powersuite module enable change-login-url

# Turn the module off
wp powersuite module disable change-login-url

# Check whether it is on, its category, and where its settings live
wp powersuite module get change-login-url

Managing more than one site? Add --url=https://example.com to point a command at one site. If this is a Pro module, install WP PowerSuite Pro and activate your license first. New to WP-CLI? See the full command guide.

FAQ

What does Change Login URL do?

It is a WP PowerSuite Pro module that moves the WordPress sign-in screen to a private URL you choose. Unauthenticated visits to wp-login.php and wp-admin return a 404 (or a redirect you configure) instead of the login form.

Is Change Login URL included with WP PowerSuite?

Yes. It ships in the WP PowerSuite Pro add-on (install Pro beside the free plugin and activate your license). You do not need a separate “hide login” plugin.

Will I lock myself out?

Only if you forget the new URL. Bookmark https://your-site.com/your-slug immediately after enabling or saving. You can turn the module off from WP PowerSuite if you still have admin access another way.

Is this real security?

No — it is obscurity. It stops casual bots and scanners from finding the default login form. Pair it with Limit Login Attempts, Two-Factor Authentication, and strong passwords.

What happens to wp-login.php after I change the login URL?

Unauthenticated visits to wp-login.php and logged-out wp-admin are blocked (404 by default). Sign in only at your custom slug (for example /your-site-crew).

Can I use the slug “login”?

Prefer an uncommon phrase such as your-site-crew. Common words like login and admin are discouraged or reserved for new choices because they are easy to guess.

Does Change Login URL work with WooCommerce?

Yes. By default, customer password resets stay on My Account. Optional Advanced settings can redirect guest My Account login or rewrite email links — leave email rewrite off unless you need it.

Does it work with Login Page Customizer and CAPTCHA?

Yes. Other PowerSuite login modules load on the private login path so branding and CAPTCHA still apply.

Does Change Login URL work on multisite?

Yes. With network-wide PowerSuite settings, the same login slug applies to all sites in the network.

What if my license becomes invalid?

Protection stops loading and default login paths are exposed again. Admins see a notice so you can renew or disable the module. Your saved slug remains stored.

Does this stop REST API or XML-RPC logins?

No. Path blocking is for browser login URLs. Use Disable XML-RPC, Disable REST API (or lock it down), and application-password controls as needed.

Developer notes (hooks & filters)

Source: modules/change-login-url/module.php. Boot: critical. Context: both. Requires a valid license before the module loads.

wp → handleCustomLoginUrl (priority 0) serves wp-login.php on the custom slug while preserving REQUEST_URI for reset cookies.
init → blockDefaultLoginUrls (priority 1) for default login / unauthenticated admin paths.
template_redirect → WooCommerce lost-password / guest My Account redirects; Gravity Forms preview redirect when applicable.
Filters: site_url, network_site_url, wp_redirect, logout_url, login_url, lostpassword_url, register_url, retrieve_password_message, wp_new_user_notification_email, and when WooCommerce is present woocommerce_lostpassword_url / woocommerce_mail_content.
Filter: wp_powersuite_is_custom_login_url_request — whether the current request is the custom login path (also forces is_login() true on that route).
Filter: wp_powersuite_skip_404_path — keeps catch-all 404 redirect modules from hijacking the custom slug.
Action: wpps_before_custom_login_render — other login UI modules prepare the screen here.
Filter: wp_powersuite_change_login_logged_in_redirect — destination when a logged-in user hits the plain custom login URL.
Filter: wp_powersuite_change_login_url_skip_path_block — skip path blocking for a request.
Settings: login_slug, blocked_behavior, blocked_redirect_url, redirect_wp_login_actions, password_url_mode, woocommerce_guest_redirect, rewrite_woocommerce_emails. Empty slug on enable is persisted via ensurePersistedLoginSlug() / lifecycle listener. Routing is URI-based (no rewrite-rule flush).

Ready for a quieter WordPress login?

Get WP PowerSuite, enable Change Login URL, bookmark your private address, and pair it with lockout and 2FA — without stacking another plugin.

Get WP PowerSuite