Walkthrough · Intermediate · 10 minutes
How to Hide the WordPress Login Page
Move wp-login off the URL every bot on the internet has memorised — a hands-on walkthrough in plain words that names the classic mistake before you reach it.
The short answer
One line covers it: move wp-login off the URL every bot on the internet has memorised — a intermediate-level job of roughly 10 minutes.
Below is the full run of steps, the error most people trip over, and the short cut worth remembering. On Hosting & Domains plans several steps are already automated away — the guide marks each one.
By the Hosting & Domains team · Reviewed 18 August 2026
Intermediate
Skill rating
10 minutes
Time budget
5
Steps in total
24/7
Support on call
No prior knowledge assumed — a hosting account, a browser and 10 minutes of attention is the whole entry requirement. Every instruction runs on our platform exactly as printed, and carries over to any standard cPanel host.
A promise before step one: nothing here is a one-way door. Any step with teeth is flagged, and the way back is printed beside it.
The outline first, then the detail
The work falls into a few clean stages: understand the real benefit, install a login-rename plugin, layer on the real defences, check the alternate entrances and know your way out in advance.
Every stage is a few minutes of unhurried clicking — the total depends mostly on how well you already know the control panel. The detailed instructions are further down; read the whole path once before you begin.
The well-worn snag
Taking the hidden URL for the security itself. An obscure address in front of a weak password is still a weak password. Renaming it is paintwork; the wall itself is two-factor authentication.
It earns a section of its own because it is no obscure edge case — it is the single commonest reason this task reaches a support queue. Knowing it in advance turns the whole job from risky into routine.
A habit worth borrowing
As the logs quieten, real attacks become visible. Once drive-by bots stop finding the login, whatever failed attempts remain are the ones worth looking at.
Habits this small are what separate the people who find hosting effortless from the people who find it draining. The same tools on both sides — a different way of working.
What a Hosting & Domains plan spares you
Steps that never deserved your time are taken out: certificates issue and reissue themselves, the installer handles application setup, the daily copy absorbs the what-ifs, and per-site settings live in a panel rather than a configuration file. The guide covers the remainder — the part that is actually about your site.
Stopped mid-guide at an awkward hour? That is exactly what round-the-clock support is for — say which step you are on and we take it from there.
The hosting these steps were tested on
Every walkthrough in this library is run on the platform we actually operate — cPanel, LiteSpeed, NVMe, one-click installs — so the instructions match your screen rather than gesturing at it from a distance.
Support means a person at any hour, and the remit covers the awkward practical questions other hosts hand straight back.
- Every step checked exactly as published
- The snag named before it arrives
- The dull steps taken out of your way
- People reachable at any hour you stall
Why Hosting & Domains
Standard on every plan
Works exactly as printed
Every step is proven on the platform we run — none of the 'your host may vary' hedging.
5 steps, nothing padded
Each stage is a few minutes of steady clicking, and the fiddly moments are labelled fiddly.
Jargon never charges you
Every term is defined on the spot or linked to the jargon buster — nothing assumes prior knowledge.
The snag, flagged up front
The classic error for this particular task is named before step one, which is how 10 minutes stays 10 minutes.
Help that keeps your hours, not ours
Stuck on step three at midnight? Support answers at any hour, mid-walkthrough included.
The dull parts automated
SSL, backups and installs look after themselves here, leaving the guide to cover only what is genuinely yours.
Quick Start
Order placed to site online
- 1
Understand the real benefit
Moving the login URL takes you out of the constant automated hammering of wp-login.php. That means quieter logs and less noise, but on its own it is not security worth the name.
- 2
Install a login-rename plugin
A login-URL plugin puts the form on yourdomain.com/your-chosen-path and answers the default addresses with a 404. Note the new path somewhere other than the site you have just locked.
- 3
Layer on the real defences
Two-factor authentication and a limit on failed attempts do the real work. The moved address thins the traffic at the door; those two are what the door is made of.
- 4
Check the alternate entrances
Make sure wp-admin redirects sensibly, and that any shop or membership login forms, which live on pages of their own, behave exactly as they did before.
- 5
Know your way out in advance
Should the plugin ever misbehave, renaming its folder in File Manager brings the standard URLs straight back. Locking yourself out with your own security is recoverable, merely irritating.
Built In
Fitted to every plan
- A renewal figure identical to the one you registered at
- WordPress and 400+ further applications installed in one click
- Free SSL on every plan, reissued before the old one lapses
- LiteSpeed caching in the server itself rather than bolted on by plugin
- Money back within 30 days on hosting plans, 7 on reseller
- The name's first year included when you order annually
- Spam and virus screening on every mailbox by default
- Mailboxes that answer at the name you hold
- WebP image optimisation built in, at no extra charge
- 99.9% uptime as the target, watched around the clock
Frequently Asked
The questions that come up most
Is hiding the login page worth doing?
For tidier logs and less brute-force noise, yes, since it is cheap and does what it claims. As a replacement for two-factor and strong passwords, no. It keeps drive-by bots out, not anyone aiming at you specifically.
What if I forget my custom login URL?
Rename the plugin's folder inside wp-content/plugins from cPanel and the default URLs come back immediately. Sign in, then pick a path you will remember and nobody could guess, and keep it somewhere off the site.
Who stands behind Hosting & Domains?
Hosting & Domains is a trading name of UK Health Care Support Ltd, registered in England and Wales — a real company with a public filing and terms governed by English law. Running that check on any host before you hand over a domain is time well spent.
Does hosting include mail?
Yes — every hosting plan includes mailboxes at your own name, with webmail, IMAP, POP and SMTP plus spam filtering on from the start. There is standalone email hosting too, for a name whose website lives somewhere else.
Keep reading
How to Block Unwanted Visitors by IP
Turn a persistent pest away at the perimeter, with clear eyes about what the tool cannot do — intermediate level, about 10 minutes.
How to Upload Files With File Manager
Get files onto your site from a browser tab, with no FTP software involved — beginner level, about 10 minutes.
Best WordPress.com vs Self-Hosted WordPress
Weighed properly, ending in a verdict rather than a table of ticks.
Reseller Hosting
White-label WHM hosting — your brand in front, monthly billing behind.
WHMCS License
Automate billing, provisioning and support for hosting clients of your own.
Changing hosts? Run through our checklist first.
A plain order of work for a move nobody visiting will notice: which files go over first, how to carry the mail across without losing a message, when exactly to repoint DNS, and the two mistakes behind nearly every outage we are asked to rescue.
The name is waiting.
Every plan carries the essentials other hosts bill as extras — and support that answers.
View Reseller Hosting plans