Does Hiding the WordPress Login Page Make My Site More Secure?
Yes. Hiding the WordPress login page is one of the most effective single steps you can take against automated brute force attacks. Bots target /wp-login.php and /wp-admin on every WordPress site because these paths are identical on every default installation. When WP Ghost changes the login path to a custom URL, bots scanning for the default path get a 404 error and move on. But hiding the login is only one layer. For real security, you need path changes for all WordPress paths, a firewall, brute force protection, and 2FA working together.
Why Hiding the Login Path Works
Every WordPress site uses /wp-login.php for authentication by default. Bots know this and target it relentlessly. A brute force attack works by trying thousands of username and password combinations against the login form. Some bots also use XML-RPC’s system.multicall method to test hundreds of passwords in a single request, which is even faster than hitting the login page directly.
When WP Ghost changes the login path to a custom URL (like /my-secret-entry), the default /wp-login.php returns a 404 error or redirects to a custom page. Bots scanning for the default path find nothing and skip your site. They cannot brute force a login form they cannot find. This alone eliminates the highest-volume automated login attacks.
Why the Login Path Is Not Enough on Its Own
Hiding the login path stops brute force attacks at the login form, but bots attack WordPress through many other entry points. Plugin vulnerabilities are exploited through direct path access (/wp-content/plugins/vulnerable-plugin/exploit.php). SQL injection is attempted through admin-ajax.php. Username enumeration happens through the REST API (/wp-json/wp/v2/users) and author archives. Script injection targets theme files and wp-includes. None of these attacks go through the login page, so a hidden login path does not stop them.
This is why WP Ghost goes far beyond login hiding. It changes over 30 WordPress paths, not just the login. It adds the 7G/8G firewall to block injection patterns. It includes brute force protection with reCAPTCHA on login, lost password, registration, comment, and WooCommerce forms. It provides 2FA with passkeys to protect authentication even if someone discovers your custom login URL. And it adds security headers to protect the browser layer. Each layer addresses a different attack vector.
How WP Ghost Protects the Login
WP Ghost gives you three layers of login protection that work together.
Custom login path. Change /wp-login.php to any URL you choose. The default path returns a 404 error or redirects to a page you specify. Configure this at WP Ghost > Change Paths > Login Security. For the full login path setup, see the Change Login Path tutorial.
Brute force protection. Even on the custom login URL, WP Ghost limits login attempts and adds CAPTCHA. Choose from Math reCAPTCHA (no API keys needed), Google reCAPTCHA V2, or Google reCAPTCHA V3. Set the maximum failed attempts, lockout duration, and custom error messages at WP Ghost > Brute Force. See the Brute Force Protection tutorial.
Two-factor authentication. If an attacker somehow finds your custom login URL and guesses the password, 2FA blocks them at the final step. WP Ghost supports authenticator app codes, email verification, and passkeys (Face ID, Touch ID, Windows Hello, hardware security keys). Passkeys eliminate phishing risks entirely. See the Two-Factor Authentication tutorial.
Frequently Asked Questions
Will hiding the login page affect my members or customers who need to log in?
No. You share the custom login URL with your members. They log in at the new URL exactly as they would at the default one. If you use WooCommerce, the My Account login form works independently from wp-login.php, so WooCommerce customers are not affected. You can also customize the lost password, registration, and activation paths individually.
What if I forget my custom login URL?
WP Ghost provides a Safe URL parameter that bypasses all path changes for a single request. Bookmark it when you set up WP Ghost. If you forget the login URL, append the Safe URL parameter to any page to access the default login form. You can also disable WP Ghost via FTP. See the Emergency Disable tutorial.
Is hiding the login a free feature?
Yes. Changing and hiding the login path, brute force protection with reCAPTCHA, and 2FA with passkeys are all included in the free version of WP Ghost.
Does WP Ghost modify WordPress core files?
No. The login path change uses server rewrite rules and WordPress filters. The actual wp-login.php file is not renamed, moved, or modified. Deactivating WP Ghost restores the default login path instantly.