Turquoise abstract wavy W logo on a black background
Turquoise abstract wavy W logo on a black background
White WP PowerSuite logo on a black background
White WP PowerSuite logo on a black background

Summarize with AI:

On This Page
Last updated: 07/09/2026

Change Login URL

Use a custom login URL instead of the default one bots love to hammer; bookmark your new address.

Overview

Give your team a custom WordPress login URL instead of relying on the familiar wp-login.php address. Change Login URL serves the core WordPress login screen at a private path and makes the default login address, logged-out wp-admin entry, and common login aliases return a 404 or a configured redirect.

WP PowerSuite also handles the surrounding account workflow, including login, logout, registration, password-reset links, core account emails, and WooCommerce-aware recovery routing. Compatible login branding and protection modules can continue working on the custom route. Change Login URL is a Pro module and requires an active WP PowerSuite license.

Solid black square
Solid black square
Who is this for?
  • Agencies providing clients with a dedicated WordPress sign-in address
  • Businesses that do not want the standard login paths used as public entry points
  • WooCommerce sites that need deliberate account and password-recovery routing
  • Teams combining a custom login address with supported login branding and protection

Features

Custom Login Address
Choose a lowercase login slug using letters, numbers, and hyphens. Reserved names and slugs that collide with existing content are rejected.
Automatic Private Slug
If no login slug has been saved, the module creates a unique access-* address on first enable so a replacement route is available immediately.
Block Standard Login Entry Points
Restrict direct wp-login.php access, logged-out wp-admin access, and common aliases such as /login, /admin, and /wp-login.
Choose 404 or Redirect
Make blocked login paths appear unavailable or send their visitors to a validated destination, with the homepage used when no destination is supplied.
Account Link and Email Rewriting
Update supported login, logout, registration, and password-reset URLs, including links in core password-recovery and new-user notification emails.
WooCommerce-Aware Password Routes
Choose automatic routing, the custom login screen, or WooCommerce My Account for supported account and recovery links.
Compatible Login Customization
Load enabled WP PowerSuite login-context modules on the custom route so supported branding and authentication features can recognize the screen.
Preserve Everyday Administration
Keep existing logged-in dashboard access and essential WordPress request types separate from the restrictions on public login entry points.

Change the Login Address, Not the WordPress Login System

  • A custom login path is useful when you want a deliberate address for clients, editors, or administrators rather than relying on WordPress's standard entry points. For example, a team could use a path such as /team-access while a request to /wp-login.php receives a 404. Change Login URL serves the actual WordPress login screen at the new address; it does not ask you to build a replacement login form or maintain a separate authentication system just to change the URL.
The module matches the custom request path without adding .htaccess rewrite rules. It also validates the slug against reserved WordPress paths and existing posts, pages, or terms so the login route does not take over an address already used by the website. The automatic access-* slug provides a starting point when none is configured, but you can choose an appropriate custom value. Bookmark the current login URL because the normal entry points are no longer a reliable route back to sign-in.

Change the Login Address, Not the WordPress Login System

  • Changing the location of the login screen would have little practical effect if the old addresses simply continued exposing the same form. WP PowerSuite therefore handles direct wp-login.php requests, logged-out wp-admin navigation, and common login aliases according to your selected blocked behavior. The default is a 404 response. Alternatively, a validated redirect can send those requests elsewhere, using the homepage when the destination field is empty.
  • These restrictions are not a blanket block on everything under wp-admin. Existing authenticated dashboard access remains available, and essential paths such as admin-ajax.php, async-upload.php, and admin-post.php are excluded from the logged-out dashboard restriction. REST, cron, command-line requests, and static assets are also outside the normal login-path blocking. The module changes the public browser entry points; it does not disable REST or XML-RPC authentication and should not be presented as complete account-access protection.

Keep Password Recovery and Registration Connected

  • A login URL change affects more than the form someone opens manually. WordPress generates links for registration, logout, password recovery, and new-account notifications, and those links need to agree with the selected login route. Change Login URL rewrites the supported WordPress URLs and core account-email links so users are directed into the intended workflow instead of being sent back to a blocked default login address.
  • Password-reset handling also preserves the public custom path while WordPress processes the request. This matters because the reset flow relies on cookies associated with that route; the module does not simply replace the current request path with wp-login.php behind the scenes. Normal recovery actions can therefore remain on the custom login address. This is different from disabling password recovery: the module changes where the supported process happens rather than removing the process itself.

Choose Recovery Routes That Fit Your Store or Membership Site

  • WooCommerce and membership websites may already have customer-facing account pages, so not every recovery link should necessarily use the private WordPress login screen. Change Login URL provides three password URL modes. Custom mode routes supported registration and recovery links through the private slug. WooCommerce mode uses the My Account lost-password endpoint. Automatic mode can use WooCommerce in storefront contexts, recognized membership pages where available, and the custom route when no suitable public account destination is selected.
  • Additional WooCommerce options let you redirect guests from the main My Account page to the login URL and rewrite supported keyed recovery links in WooCommerce emails. These options remain off unless you choose them. Their purpose is compatibility and deliberate routing, not absolute secrecy: a recovery email that points to the custom slug necessarily shares that address with its recipient. Similarly, the optional legacy-action redirect behavior can disclose the route. Choose these conveniences with that trade-off in mind rather than treating the custom address as an undiscoverable secret.

Keep Branding and Login Extensions on the Custom Route

  • A custom path can cause problems when a login extension only recognizes the original WordPress address. WP PowerSuite marks the replacement route as a login request and loads enabled modules for the login context. That gives compatible login extensions a supported place to initialize instead of leaving the custom screen without the behavior you configured for wp-login.php.
For a simple branded sign-in screen, Custom Login Logo and Custom Login Logo Link explicitly support this custom-login bootstrap. The logo image and its destination can therefore remain consistent on the replacement address. Sites using the broader Login Page Customizer have a supported preview context as well. WP PowerSuite's compatible 404 handling also knows to skip the custom login path, preventing the chosen sign-in address from being mistaken for an ordinary missing page.

Preserve Special Actions and Plan for Access Recovery

  • A user who is already logged in normally does not need to see an ordinary sign-in form again. A plain visit to the custom login address redirects that user to the dashboard, while special actions such as logout, password reset, two-factor verification, user switching, interim login, and supported privacy requests remain on the appropriate login workflow. After logout, an interstitial gives the user links to sign in again or return to the website rather than immediately presenting an unexplained redirect.
  • Before enabling the module, make sure the new address is available to the people who need it. On a Multisite installation, the saved slug is shared across sites, so it should be chosen as a network-level decision rather than an independent per-site setting. If the address is lost, recovery can require another administrator or access through the database or WP-CLI to disable the module. The feature does not provide a separate emergency recovery link, and changing the login URL does not replace the need to protect the accounts that can use it.

Use Cases

  • Client Sign-In Addresses
    Give clients a dedicated login path while preserving the WordPress authentication screens and account actions they already use.
  • Standard Login Path Restrictions
    Return a 404 or redirect when logged-out visitors request the default login address and supported common aliases.
  • WooCommerce Account Routing
    Keep customer-facing recovery links on My Account where appropriate while using a custom login route elsewhere.
  • Branded Login Workflows
    Combine a custom path with supported logo and login-page modules so the sign-in address and presentation work together.
  • Multisite Login Conventions
    Use one configured slug across the network when administrators want a consistent sign-in path for each site.

Frequently Asked Questions

Related Modules

Google Sign-in

Sign in with Google—simple for visitors, optional auto-registration for new users.
Login and Users
Disabled

Login Session Manager

View active WordPress login sessions, force logout users, and limit concurrent sessions by role.
Login and Users
Disabled

Last Login Column

Last login time in the Users table so you can see who has been active recently.
Login and Users
Disabled

Login Page Customizor

Brand the login page with colors, background, and layout options.
Login and Users
Disabled

Generic Login Error Message

Same friendly login error every time—stops people from fishing for valid usernames.
Login and Users
Disabled

Temporary Login

Expiring, one-click login links for vendors or support—no shared passwords, with optional limits and a simple activity log.
Login and Users
Disabled

GitHub Sign-in

GitHub login for your site—great for technical audiences, with optional new-user signup.
Login and Users
Disabled

Alphabet Avatars

Letter-based profile images with customizable colors—great when you want a polished look without relying on Gravatar.
Login and Users
Disabled

Username Changer

Let members update their login name from their profile when life changes—fix a typo, drop an old email-style handle, or match a...
Login and Users
Disabled

Custom Login Logo

Your logo on the login page for a branded sign-in experience.
Login and Users
Disabled