Change wp-admin URL?

It is extremely important to record the address of your new login after you change it but other than that, its a fabulous security enhancement.

I use this simple plugin on over 600 wordpress sites:
Rename wp-login.php

Thanks, Ripefruit. I was avoiding that one because the developer says he / she is no longer fooling with it, so it would be unsupported. However, if you’re using it on 600 sites with no problem, then I should probably give it a shot. I would think that this would put a permanent end to the daily litany of e-mails that WordFence sends me about people from all over the world trying to log in and getting locked out for a period of time, for the numerous (though nowhere near 600) sites that I manage.

I decided to go with WPS Hide Login instead of Rename wp-login because that one is being actively maintained and appears to do exactly the same thing. Thanks again for the tip, Ripefruit!

I might have to disagree with you guys, but in the spirit of helping. Why?

I had renamed wp-login.php and it was also in a custom folder. But for example, last night, I endured a 13hr single ip brute force attack that was targeting a location of the wp-login.php that doesn’t even exist.

15,000 requests made from the same IP to the same url, stubborn and wasteful as could be. Word fence was blocking it no problem, exactly as it should serving a 503 yet, the attack was crippling my shared server cpu. It didn’t kill it, but it sure was hitting hard. Imagine if 2 if these attacks overlapped.

Anyway, no way to stop the actual stubborn failing hacker bot, until I added a whitelist to my htaccess file only allowing my home ip to access the wp-login.php file, regardless of its true url. It worked wonders. I am new to this, but I could tell that with this sort of bullying attack, htaccess was the way to go. Server load reduced to a minimum in comparison no disrespect to Wordfence.

I am using Wordfence as a 2nd line if defence. I will miss the statistics that Wordfence was providing for failed login attempts but oh well, I can review the raw access logs if I’m curious. So in conclusion, correct me if I’m wrong, but renaming wp-login.php is futile. It would be better to let 3 attempt happen else block with WordPress. And I suppose for multi user logins and or blogs, my method would not be so useful.

@themadproducer: Thanks again for pitching in! It’s definitely correct that you can’t stop the bots from trying.

Thank you everyone, also, for the input — we do get a request for this feature from time to time (at least, renaming wp-login.php, but not necessarily wp-admin which is hard to do safely), so I will add this to the pending request for discussion. I can’t promise when or if it will be added to a release, but all suggestions are considered seriously. Thanks!

-Matt R
FB567