Every WordPress site in the world has a login page at the same predictable address: /wp-admin. Ask around and you’ll hear that this is a security problem, and that moving it to something secret is a smart fix. It’s one of the most common pieces of WordPress security advice out there. It’s also mostly beside the point, and believing it can quietly leave the real doors unlocked.
What moving the login page actually does
Automated bots constantly scan the web, hitting /wp-admin on every WordPress site they find and trying common username/password combinations. Renaming your login URL means those generic, automated attempts fail instantly, because they’re not looking anywhere else. Your server logs get quieter. That’s a real, if modest, benefit: less noise, slightly less load from bot traffic.
What it doesn’t do
It doesn’t stop a targeted attack. Anyone specifically trying to get into your site can find the real login URL in minutes; it’s rarely hidden as well as people think, and plenty of WordPress setups leak it through other pages regardless. More importantly, it does nothing about the actual ways WordPress sites get broken into:
- A weak or reused password on the admin account
- An outdated plugin with a known, published vulnerability
- No limit on login attempts, so a bot can guess passwords all day once it does find the page
- No two-factor authentication, so a leaked password is game over
This is the trap with “security through obscurity”: hiding the door feels like progress, but it’s not the same as locking it. I’ve seen sites with a cleverly disguised login URL that were still running a plugin with a publicly known security hole from eight months earlier. The obscurity didn’t matter at all: the attacker didn’t need the login page, they walked in through the plugin.
What actually stops hackers
In order of how much they matter:
- Keep WordPress core, themes, and plugins updated. The large majority of WordPress hacks exploit a vulnerability that was already patched: the site just never installed the update.
- Use strong, unique passwords, and turn on two-factor authentication. This alone closes off the most common way accounts get taken over.
- Limit login attempts. A few plugins do this for free, and it kills off basic password-guessing regardless of how well-known your login URL is.
- Keep tested backups. Not strictly “prevention,” but it’s what turns a hack from a catastrophe into an annoying afternoon.
Moving your login page isn’t wrong to do: if it’s already built into your security plugin, leave it on, it costs nothing and cuts down bot noise. Just don’t mistake it for the fix. The boring stuff (updates, passwords, backups) is the actual fix, and it’s also, not coincidentally, the exact list of things a $150/month maintenance plan exists to handle every single month, whether or not you ever think about it again.