Have you taken the most basic step to secure your WordPress site? I‘m talking about obscuring your wp-login and wp-admin pages.
Leaving these default admin URLs intact is like rolling out the welcome mat for brute force attacks. It invites trouble.
In this guide, I‘ll show you why hiding your WordPress login area is critically important and walk through exactly how to change those admin URLs.
Brute Force Attacks Are Like Battering Rams Targeting Your Login Page
To understand the value of an obscured login URL, you need to know what a brute force attack is:
A brute force attack is when a hacker uses software to guess usernames and passwords repeatedly, trying countless combinations at high speeds.
Their goal is to break into your WordPress admin area by landing on the right login credentials through pure guessing.
With enough attempts across enough sites, brute force attacks inevitably succeed.
According to Jetpack:
- Over 90% of WordPress sites will experience a brute force attack at some point
- The average WordPress site suffers 52 brute force attacks per day
- A single attacker can test over 1,800 password combinations per minute
Once brute forcers access your dashboard, they can do serious damage:
- Deface or delete content
- Install malware like cryptojackers to steal site resources
- Add hidden backdoors and admin users to maintain access
- Steal sensitive customer and business data
- Hold site access for ransom
Obscuring your admin URL acts like putting on a helmet to deflect these pounding guessing attacks targeting wp-login.php.
Instead of that predictable access point, hackers have to blindly guess at a custom URL. Their brute force programs spin fruitlessly.
Changing Your Admin URL Only Takes A Minute
Many WordPress site owners wrongly assume that hiding wp-login would be complicated.
I‘m happy to tell you it‘s incredibly simple!
With a handy plugin like WPS Hide Login, you can switch to a secret admin URL in just 60 seconds.
- Install and activate the WPS Hide Login plugin
- Go to Settings > Permalinks
- Enter your preferred custom admin URL
- Click Save Changes
Got one minute? You now have an obscured login area that is exponentially harder to hack.
Later, I‘ll suggest an expanded security plugin that also allows changing other sensitive URLs like wp-admin.
But WPS Hide Login is all you need to shield the login page alone.
First, let me convince you why making this quick change is so critical…
Hackers Salivate Over Default wp-login Access
Like wolves to an unlocked door, hackers crave effortless access points. The wp-login URL (and wp-admin to a lesser degree) act like catnip to brute forcers.
They know that if they bang on your site‘s login page long enough, they can eventually guess working credentials.
In fact, security researchers found that:
- WordPress admin pages receive 96% of all attacks targeting CMS platforms
- Default admin URLs account for 77% of compromised WordPress sites
By using predictable paths like /wp-login.php, you hand over the keys to hackers.
Here‘s why obscured admin URLs halt so many attacks:
Benefits of Changing Your WordPress Login URL
- Stops 99% of automated brute force attacks
- No wp-login page means fewer clues about your infrastructure
- Adds security through obscurity, hiding access points
- Prevents access to xmlRPC which can expose vulnerabilities
- It‘s like putting on a helmet against pounding login attacks
I often explain it this way…
Hiding your login URL cuts down hacking attempts as dramatically as eliminating the front door to your house reduces unwanted visitors. Intruders must work considerably harder to find another way in.
But while this single step massively boosts site security, it doesn‘t make you invulnerable. Let‘s talk about other ways to defend against brute forcing.
Additional Brute Force Defenses For WordPress Sites
An obscured admin URL serves as the cornerstone for securing against brute force attacks. But you need backup layers as well:
- Use very strong passwords with maximum complexity and length
- Limit login attempts to block IPs after a small number of failures
- Monitor site activity closely for signs of compromise
- Prevent user enumeration by disabling author archives
With these secondary measures in place, your site approaches brute force immunity.
Now let‘s dig into plugins that make the process easy…
WPS Hide Login vs iThemes Security for Changing Admin URL
I introduced the superb WPS Hide Login plugin previously for altering your core login URL. It takes literally 60 seconds.
However, iThemes Security offers added flexibility:
WPS Hide Login
- Simple, lightweight plugin solely focused on login URL
- Easy setup with instant results
- Does not modify core files which is safer
iThemes Security
- Comprehensive security suite including login obscuring
- Also hides wp-admin, register, lost password pages
- More control through added features and customizations
- Premium plugin that requires license after first year
So while WPS Hide Login is the quicker, lighter option, iThemes Security provides expanded functionality.
I suggest WPS to start since it delivers the most vital protection against brute forcing. Then consider expanding site security further through iThemes later on.
Now I‘ll walk through exactly how to apply these plugins to obscure your WordPress login.
Step-by-Step Guide: Hide Your WP Login Area
Let me outline the simple process so you can instantly add this vital layer of security:
Install and Activate WPS Hide Login
- Login to your WordPress dashboard
- Click "Plugins" then "Add New"
- Search for "WPS Hide Login" and click Install Now
- When installation finishes, click Activate Plugin
This instantly hides your default login URLs behind the scenes. But visitors can still access those pages for now.
Next, we‘ll set up your secret custom URL…
Choose Your New Admin URL
- Go to Settings > Permalinks
- Scroll down to the WPS Hide Login section
- Enter your preferred new admin URL like "yourURL"
- Click Save Changes
That‘s seriously all it takes to obscure arguably the most important page on your site from hackers.
Visitors will no longer be able to access wp-login.php. Only your new masked URL allows dashboard access.
Obscure Your Login Page Before Disaster Strikes
I hope this guide has convinced you that hiding your WordPress login area issecurity priority #1.
No other single step does more to halt brute force attacks and prevent unauthorized access.
So before you leave this page, follow along above to apply WPS Hide Login plugin. Choosing a secret URL only takes a minute to potentially avoid a disastrous hack down the road.
The peace of mind is so worth that small bit of effort!
Now over to you:
Have you already hidden your WordPress login URL? How has it impacted site security for you? Share your experiences below!
