Custom login URLs and login links in WordPress: what they do and don't protect

Logins & site admin · Published 2026-10-11

A keypad lock with a lever handle on a wooden door — A keypad lock on an office door.

Everyone knows a WordPress login page lives at /wp-login.php. Changing that address, or replacing passwords with emailed links, are popular ideas. Here is what each really achieves.

This address once hosted the ShiftThis "URL Login" plugin, discontinued long ago and not available here. This guide describes current ways to customise how and where users log in.

Where WordPress logs people in

The login form is handled by wp-login.php. Visiting /wp-admin/ while logged out redirects there, and WordPress also redirects the shortcuts /login and /admin to it, unless a page with that address exists. The form posts to the same file, which sets an authentication cookie on success.

Changing the login address

How it works

Plugins such as WPS Hide Login intercept requests so the form answers at an address you choose, for example /team-entry/, while direct requests to wp-login.php and /wp-admin/ by logged-out visitors get a "not found" response or a redirect elsewhere. Core functions that build login links, such as wp_login_url(), are filtered to point to the new address, so themes and emails stay consistent.

What it achieves

It removes most automated noise: bots that hammer the default address stop reaching the form, which reduces log clutter and server load. That is a real operational benefit.

What it does not achieve

It is not a security control on its own. The new address can leak through emails, browser history or a misconfigured plugin, and xmlrpc.php and the REST API still accept credentials. A strong password and two-factor authentication protect the account wherever the form is; a hidden address protects nothing if the password is "password1". Treat it as a convenience layered on top of real measures (see Locking WordPress down).

Before you change it

Bookmark the new address and tell other users. Forgetting it is the most common support problem with these plugins.
Check plugins that link to the login page (membership, shop, forum plugins); test their login and password-reset flows.
Know the recovery path: deactivating the plugin by renaming its folder over FTP restores wp-login.php.
Avoid doing it with server rewrite rules alone: requests that bypass the rule still reach the real file.

Sending users to the right place after login

By default, users land in the dashboard. For subscribers or customers that is rarely useful. The login_redirect filter changes the destination:

add_filter( 'login_redirect', function ( $redirect_to, $requested, $user ) {
    if ( $user instanceof WP_User && ! $user->has_cap( 'edit_posts' ) ) {
        return home_url( '/account/' );
    }
    return $redirect_to;
}, 10, 3 );

A login link can also carry its own destination: wp_login_url( get_permalink() ) produces a link that returns the user to the current page after signing in, through the redirect_to parameter. WordPress validates that parameter so that it cannot send users to an outside site.

Putting the login form elsewhere

To show a login form inside a page rather than on the separate login screen, use the Login/out block in a block theme, or wp_login_form() in a template. Both submit to the standard login handler, so security plugins keep working.

Passwordless login links

"Magic links" replace passwords with a one-time link emailed to the user. WordPress core does not provide them; plugins do, and some membership and e-commerce plugins include them.

They can be safer than weak, reused passwords, but they move the trust to the user's mailbox: whoever can read the email can log in. A good implementation:

makes each link single-use and short-lived (minutes, not days);
stores only a hash of the token, never the token itself;
limits how often links can be requested, to prevent email flooding;
does not reveal whether an address has an account;
is not used for administrator accounts without a second factor.

Never build login links that embed a username and password in the URL. URLs end up in server logs, browser history, analytics and the Referer header sent to other sites.

A related, standards-based option is passkeys, which let users sign in with a device's fingerprint, face recognition or PIN instead of a password. Several WordPress plugins add passkey support; the FIDO Alliance's passkeys overview explains how they work.

Summary

Goal	Approach
Fewer bot hits on the login form	Custom login address, firewall rules
Accounts that resist attack	Strong passwords, two-factor authentication, passkeys
Users land on a useful page	`login_redirect` filter or `redirect_to` links
Login inside the site's design	Login/out block or `wp_login_form()`
No passwords for occasional users	A well-built magic-link or passkey plugin