Two million active installs, 96 out of 100 from 2,111 ratings, and an interface consisting of two text fields. There's no settings page, no dashboard, no onboarding wizard and no upsell. It's one of the most-installed plugins on WordPress.org and you could describe everything it does in a single sentence.
That's worth a review precisely because the simplicity hides a decision people get wrong. Changing your login URL is useful and it isn't security, and a lot of sites install this instead of the measures that actually matter. Changing your WordPress login URL covers the methods in general.
The short version
| Best for | Cutting the volume of automated login attempts on any site |
| Price | Free. There is no paid tier |
| Interface | Two fields at the bottom of Settings > General |
| Best thing about it | It does one job, does it well, and asks nothing else of you |
| Worst thing about it | What people believe it does |
| Skip it if | You think it replaces rate limiting or two-factor |
The numbers
From the WordPress.org Plugin API, re-pulled 1 September 2026.
| Metric | Value |
|---|---|
| Active installs | 2,000,000 |
| Rating | 96/100 from 2,111 ratings |
| Five-star / one-star | 1,986 / 62 |
| Requires | WordPress 4.1, PHP 7.0 |
| Price | Free, no paid tier |
Two million installs is the largest number anywhere in this cluster, ten times LoginPress and forty times Colorlib's login customizer. Sixty-two one-star ratings out of 2,111 is a 2.9 per cent complaint rate at a scale where almost every possible host, theme and plugin combination has been tried by somebody.
Its tested-up-to version matched the current WordPress release when we checked, and it had shipped a release within the previous month. On a plugin that sits on the authentication path, that's the field that should reassure you most, and it's the one to re-read on its WordPress.org listing before you install it.
The entire plugin
Two fields.
Login url. The address your login screen moves to. Type login and your login lives at yoursite.com/login.
Redirection url. Where everyone who requests the old address gets sent. The default is 404, which serves your site's not-found page and tells a scanner nothing.
That's it. Save Changes, and the job is done.
A small correction to something we've written before: the plugin adds no top-level admin menu, which is the restraint people praise it for, but it does add a Settings > WPS Hide Login submenu entry that links to the section. Both facts are visible in the screenshot above.
The settings block also carries vendor links: a support forum, a note that the plugin comes from WPServeur, and pointers to four sibling products. It's the only promotional surface in the plugin and it sits below the fields rather than in front of them. Some people find it noisy. Given that this is a free plugin with no paid tier, it seems a fair trade.
What it actually protects against
This is the part that decides whether the plugin is worth installing, and it's the part most write-ups skip.
The overwhelming majority of login attempts on a WordPress site are automated and generic. A script walks a list of domains, requests /wp-login.php on each one, and starts trying credentials. It doesn't read your site, it doesn't look for a custom URL, and it moves on when it gets a 404.
Against that traffic, a changed login URL is close to perfectly effective, and the benefit isn't only security. Those requests cost CPU, fill error logs, trip rate limiters and, on cheap shared hosting, measurably slow the site. A lot of what people describe as "the site feels faster after installing this" is exactly that.
What it does not stop:
- A targeted attacker. Anyone who wants into your site specifically will find the URL. There are several ways it leaks, listed below.
- A weak or reused password. Once someone reaches the form, the URL has done its whole job.
- A leaked or guessable username. Author archives and the REST API both enumerate users by default: the WordPress REST API leaks usernames, and changing a WordPress username covers the fix.
- Anything that is not the login form. XML-RPC, a vulnerable plugin, an insecure host, a stolen session cookie. None of them care where your login page is.
So the honest framing is that this plugin removes noise rather than removing risk. That's genuinely worth having. The best WordPress login security plugins covers what does the actual work.
One thing it does better than a code snippet
Worth naming, because it's a real technical distinction. Most "change your login URL" snippets you'll find online hook init and redirect GET requests to wp-login.php. That's cosmetic: a direct POST to wp-login.php still authenticates, so bots are entirely unaffected.
WPS Hide Login's own field text describes it as preventing access to wp-login.php and the wp-admin directory for people who aren't logged in, which is a stronger claim than a redirect. If you're choosing between this plugin and a snippet you copied from a forum, that difference is the reason to choose the plugin.
The URL leaks more easily than you think
Four common paths, and none of them requires an attacker to be clever.
Referrer headers. Click an external link from a page whose URL contains your login slug and the destination server may see it in its logs.
Plugins and themes that hard-code the login address. Anything generating a "Log in" link with wp-login.php written into it will either break or expose the real address. This is also the most common cause of "WPS Hide Login broke my site" reports.
Password reset emails. Reset links contain the login URL by design. Every reset email is a copy of your secret sitting in an inbox.
People. A team member pastes it into a shared document, a support ticket, or a message to a contractor. This is the leak that actually happens.
None of these is a reason not to use the plugin. They're reasons to treat the URL as a filter and not as a password, and to put a real password policy and two-factor behind it: two-factor authentication for WordPress admin.
If you lock yourself out
This is the plugin's only real risk, and it's entirely a human one: you forget the URL, or a client does, and now nobody can reach the login screen at all.
Two ways back in. Neither needs the login page.
Over SFTP. Rename the plugin's folder in wp-content/plugins/. WordPress can't find the plugin, deactivates it, and wp-login.php works again immediately. Rename it back afterwards and set a URL you'll remember.
wp-content/plugins/wps-hide-login/
↓ rename to
wp-content/plugins/wps-hide-login-disabled/With WP-CLI, if your host provides SSH:
wp plugin deactivate wps-hide-loginThree things to do before you ever need either of those:
- Write the URL down where you keep passwords, not in a browser bookmark on one machine.
- Tell every person who logs in. A client who can't find their login page at nine on a Monday won't remember which plugin caused it.
- Do not change the login URL in the same session as anything else. If two changes break the site you won't know which one did it.
If you're already locked out and the situation is worse than a forgotten URL, fixing WordPress login page issues covers redirect loops, wp-admin redirecting to the homepage covers that specific symptom, and resetting a WordPress admin password covers the database and WP-CLI routes.
Known friction
Three situations where this plugin needs attention rather than installation and forgetting.
Caching. A full-page cache or a CDN that has cached a redirect or a 404 for the old address can produce confusing behaviour after a change. Clear every cache layer immediately after saving, and test in a private window.
Plugins that hard-code wp-login.php. Membership plugins, some form builders and some themes generate login links directly. Those links will land on your redirection target. Audit your "Log in" links after enabling this.
Multisite. Behaviour differs between a network-wide activation and a per-site one, and it's worth reading the plugin's own notes rather than assuming. This isn't a place to guess.
What WPS Hide Login does well
Scope discipline. Two fields. No dashboard, no notifications, no weekly summary email, no upsell modal. In a category where every competitor is a suite, this is a genuine design achievement and it's why two million people run it.
It is free, permanently. No pro tier, no locked features, no licence key. There's nothing to renew and nothing to forget to renew.
Maintenance. Current on both the last-updated and tested-up-to fields when we checked. For a plugin on the authentication path that matters more than any feature.
Evidence. 2,111 ratings at 96/100. Whatever edge case you're worried about has almost certainly been hit by somebody already.
It stops the POST too, unlike the redirect snippets that circulate on forums.
Where it falls short
What people believe it does. The biggest problem with this plugin is that a lot of sites install it and consider login security finished. It's one thin layer.
No lockout safety net. No email reminder of the URL, no grace period, no emergency access token. Losing the URL means an SFTP session.
It cannot help with anything else. No rate limiting, no two-factor, no logging, no notification when someone tries the old URL. Whether that's a fault or the entire point depends on your view.
The sibling-product links. Four promotional links inside the settings block. Minor, and worth mentioning because "no upsell" is part of this plugin's reputation and isn't quite true.
Who should install it
Almost any WordPress site. It's free, it's two fields, it measurably reduces junk traffic, and at two million installs it's about as well-tested as WordPress plugins get. As one layer among several, it's easy to recommend.
Sites on cheap shared hosting, where the CPU cost of constant bot traffic is a real performance problem rather than a theoretical one.
Anyone who has just read a log full of failed login attempts and wants the volume to stop today.
Who should look elsewhere
Anyone who wants this instead of real login security. Rate limiting and two-factor do the work. The tested comparison covers both.
Anyone who wants the login screen to look like their brand. Different job entirely. WPS Hide Login changes the address and doesn't touch the design: the best WordPress login page plugins, or how to customize the WordPress login page.
Anyone who wants login redirects by role. Also a different job: redirecting users after login by role, which in our stack lives in WP Adminify.
Anyone managing many client sites who wants one plugin for the URL, the redirects and the branding. That's a consolidation argument, and it's a fair one, though it means running a bigger plugin than this one.
Frequently asked questions
Is WPS Hide Login safe to use?
Yes, with one precaution: record the login URL somewhere you can reach without logging in. The plugin has 2,000,000 active installs and 96/100 from 2,111 ratings, and its tested-up-to version was current when we checked. Its only real risk is a human one, which is losing the address you set.
Does WPS Hide Login actually improve security?
It removes noise rather than risk. Automated bots requesting /wp-login.php stop reaching your login form, which cuts junk traffic and log volume substantially. It does nothing about weak passwords, leaked usernames, XML-RPC or a vulnerable plugin, so treat it as one thin layer above rate limiting and two-factor rather than a replacement for either.
What happens if I forget my login URL?
Rename the plugin's folder in wp-content/plugins/ over SFTP and WordPress will deactivate it, restoring wp-login.php. With SSH access, wp plugin deactivate wps-hide-login does the same thing. Neither route needs the login page, so you're never permanently locked out.
Is WPS Hide Login free?
Yes, entirely, with no paid tier and no locked features. It's published by WPServeur, a WordPress specialist host, and its settings block carries links to four sibling plugins, which is the only promotional element in it.
Does it break other plugins?
It can, in one specific way: anything that generates a login link with wp-login.php hard-coded into it will point at your redirection target instead. Membership plugins, some form builders and some themes do this. Check every "Log in" link on the site after enabling it, and clear all caches.
Is a hidden login URL enough on its own?
No. It filters generic automated traffic and nothing else. A targeted attacker will find the URL through a referrer header, a hard-coded link, a password reset email or a person sharing it. Put strong unique passwords, rate limiting and two-factor behind it.
Where this belongs in a security stack
In order of how much they actually protect you:
- Strong, unique passwords, and no username called
admin. Everything else is decoration without this. - Rate limiting on failed attempts. The measure that stops credential stuffing.
- Two-factor on every account that can install a plugin. The practical version.
- Generic failure messages, so the form doesn't confirm which usernames exist: customizing WordPress login error messages.
- A changed login URL. This plugin. Useful, cheap, and the thinnest layer of the five.
If you've done one through four, add this. If you've done only this, you've tidied your logs.
The verdict
WPS Hide Login is an easy plugin to recommend and an easy one to misunderstand.
It does exactly one thing, it's free, it's maintained, and at two million installs it's among the most thoroughly exercised plugins on WordPress.org. It will cut the automated login traffic hitting your site to almost nothing, and on cheap hosting that's a performance win as much as a security one. It's also better than the redirect snippets people copy from forums, because it closes the POST as well as the GET.
Install it. Write the URL down. Then go and do the things that actually protect the login, because this one is the thin layer on top, not the foundation.
For the methods including the code route, changing your WordPress login URL. For the layers underneath, the best WordPress login security plugins. And for the design half of the login page, which this plugin deliberately never touches, the WordPress login page white-label guide.
Your email address will not be published