Can I Change WP-Admin to Something Else in WordPress?
This tutorial has moved to the new WP Ghost Knowledge Base where each feature is presented in detail.
Yes. Go to WP Ghost > Change Paths > Admin Security and enter your custom name in the Custom Admin Path field. Click Save. WP Ghost replaces /wp-admin with your custom path using server rewrite rules. The actual wp-admin directory is not renamed or moved. Bots scanning for the default /wp-admin get a 404 error, while you access the dashboard through the new URL.
Why Changing wp-admin Matters
The /wp-admin directory is the single most recognizable WordPress path. Every WordPress installation uses it, and every bot scanning for WordPress targets it. Bots probe /wp-admin to confirm a site runs WordPress, to access the login redirect (since visiting /wp-admin when logged out redirects to the login page), and to attempt direct access to admin files and AJAX endpoints. Changing this path breaks the first step in the automated attack chain.
How to Change wp-admin
Go to WP Ghost > Change Paths > Admin Security. Enter your custom admin path in the Custom Admin Path field. Choose something unique and not guessable. Avoid common alternatives like /admin, /dashboard, or /backend as bots check these too. A random string or a site-specific term works best.
After saving, log out and log back in so WP Ghost creates a session for both the default and custom admin paths. Bookmark the new admin URL immediately. If you also enable the Hide “wp-admin” option in the same section, the default /wp-admin path will return a 404 error for anyone not logged in, which is the recommended configuration.
Clear all cache after making the change. Test the new admin URL in a private browser window by logging in through your custom login path first, then navigating to the custom admin URL. For the full admin path configuration guide, see the Change wp-admin Path tutorial.
Important: Change the Login Path Too
Changing wp-admin alone is only half the job. When a non-logged-in visitor accesses /wp-admin, WordPress redirects them to /wp-login.php. If you change the admin path but leave the login path at default, the redirect still exposes the login page. For complete protection, change both: the admin path in Admin Security and the login path in Login Security. WP Ghost handles both independently, and Ghost Mode changes them together automatically.
Frequently Asked Questions
Will changing wp-admin break my plugins?
In most cases, no. WP Ghost uses virtual rewrite rules, so your actual files and folders stay exactly where they are. Plugins that rely on admin-ajax.php or the REST API continue working because those are separate endpoints. On some managed hosting environments (like WP Engine or Nginx-only servers), custom admin paths may need additional server configuration. If you experience issues, revert the admin path to default in WP Ghost while keeping all other security features active.
What if I forget my custom admin URL?
Use the Safe URL parameter to bypass all WP Ghost path changes for a single request. This lets you access the default /wp-admin temporarily. You can also disable WP Ghost via FTP or add define('HMWP_DISABLE', true); to wp-config.php. See the Emergency Disable tutorial for full recovery options.
Is this a free feature?
Yes. Changing and hiding the wp-admin path is included in the free version of WP Ghost.
Does WP Ghost modify WordPress core files?
No. The wp-admin directory is not renamed, moved, or modified. WP Ghost uses server rewrite rules to create a virtual path that maps to the original directory. Deactivating WP Ghost restores the default /wp-admin path instantly.