How to Hide Your WordPress Login URL with Datametric Login Shield
Every WordPress site on Earth ships with the same front door: wp-login.php. Attackers know exactly where it is — which is why it’s the single most hammered URL on your site. Datametric Login Shield hides that door and stacks real defenses behind it.
On this page
Tags: WordPress Security, Free plugin
Make your WordPress login invisible
Every WordPress site on Earth ships with the same front door: wp-login.php. Attackers know exactly where it is — which is why it’s the single most hammered URL on your site. Datametric Login Shield hides that door and stacks real defenses behind it.
The most attacked door on the internet
WordPress powers a huge share of the web — often cited around 40%. That popularity has a side effect: because every site uses the same login path, attackers never have to look for your login page. WordPress tells them where it is. Automated botnets simply request yoursite.com/wp-login.php and start guessing.
What that automated traffic usually looks like:
Brute force
A bot pounds wp-login.php with common passwords against a guessed username. High volume, few IPs.
Credential stuffing
Username/password pairs leaked from other breaches are replayed here, betting on password reuse — spread across many IPs.
Username harvesting
Before guessing passwords, bots scrape valid usernames via ?author=1 redirects and the REST endpoint /wp-json/wp/v2/users.
XML-RPC amplification
xmlrpc.php historically let attackers test many passwords in a single request, multiplying brute-force speed and dodging naive rate limits.
Hiding the door helps — but it isn’t the whole lock
Let’s be honest, because your credibility depends on it: moving your login URL is security through obscurity. It won’t stop a determined, targeted attacker who can inspect traffic or find a theme that hardcodes wp-login.php.
What it does do is remove you from the untargeted, automated flood — the overwhelming majority of login attacks, which only ever hit the default path. That kills the noise. The real controls behind the hidden door stop the attackers who are smarter than a blind bot. That layering is exactly what defense in depth means, and it’s why Login Shield is more than a URL trick.
One plugin, six independent layers — each one catches what the previous layer misses.
A guided tour of the panel
Step 1
A login address only you know
Change your login from wp-login.php to something like /secret-door. Visitors who don’t know the address get a plain 404 — there’s no hint a login page ever existed there.
Crucially, it works by intercepting the request in PHP. It never renames or edits a single core file, and it adds no .htaccess or rewrite rules. Deactivate the plugin and your default login returns instantly — nothing to clean up. That’s why it runs on any host: Apache, Nginx, LiteSpeed, anywhere.
Step 2
Lock it down for the bots that get through
- Brute-force lockout. Too many failed logins from an IP? It’s locked out for a window you choose. An allowlist means you can never lock yourself out, and it fails open on a database error, so a glitch can never bar every user.
- Two-factor (TOTP). A six-digit code from Google Authenticator, Authy or 1Password — so a stolen password alone is useless. Ships with single-use backup codes and per-role enforcement. (TOTP apps and backup codes only — no SMS or email OTP.)
- Access hardening. Hides
/wp/v2/usersfrom logged-out callers, redirects?author=Nscans, shows a single generic login error, and can optionally disable XML-RPC. - IP allow / deny. Restrict login to your office or VPN ranges (CIDR supported), or block known-bad addresses outright.
- CAPTCHA (optional). reCAPTCHA v2/v3, hCaptcha or Cloudflare Turnstile, verified server-side.
Step 3
See exactly who is knocking
A filterable audit log records logins, failed attempts, logouts and lockouts — with date, user and IP. Get an email the moment an IP is locked out or an administrator signs in, and export the whole log to CSV (with formula-injection safely neutralized).
Anti-lockout
Built so you’re never stranded
The dashboard shows your status at a glance and lets you copy your login URL or email it to yourself in one click. Locked out anyway? Rename the plugin folder over FTP, or set one recovery constant in wp-config.php (DMLS_DISABLE_2FA, DMLS_DISABLE_IP_ACCESS, DMLS_DISABLE_CAPTCHA), fix the setting, and remove it. You are designed to always have a way back in.
What it does not do
No honest security tool claims to make you bulletproof. Here’s the straight talk:
- ✗ It does not make your site “unhackable” or your login “undiscoverable.”
- ✗ It is not a firewall (WAF) and it does not stop DDoS.
- ✗ It can’t help if a theme or plugin hardcodes
wp-login.php. - ✗ A distributed botnet rotating thousands of IPs can slip under a per-IP lockout — that’s what 2FA and CAPTCHA are for.
- ✗ It is no substitute for strong, unique passwords and keeping WordPress updated.
- ✗ Behind a caching layer, exclude your login URL from cache (most caching plugins already do).
Privacy-friendly by default
Everything runs on your own server. Nothing leaves it unless you enable CAPTCHA — in which case the challenge and visitor IP are sent to your chosen provider (Google, hCaptcha or Cloudflare) to verify. Failed-attempt records auto-delete after 24 hours; audit events after 7 days.
Because IP addresses are personal data under the GDPR, the plugin gives you the tools to stay compliant: turn logging off, store anonymized IPs, delete everything on uninstall, and auto-generate privacy-policy text. It hands you the controls — it doesn’t pretend compliance is automatic.
Coming from WPS Hide Login?
Switching is seamless. Login Shield automatically imports your existing custom login URL, so your current address keeps working the moment you activate — no reconfiguration, no downtime.
Standing on open-source shoulders
Datametric Login Shield is an independent, GPLv2 fork of WPS Hide Login, originally created by WPServeur, NicolasKulka and wpformation. The core login-interception logic is derived from their proven work — our sincere thanks to the original authors. (Independent fork; not affiliated with or endorsed by them.)
Requirements & compatibility
Tags: WordPress 6.2+, PHP 7.2+, Multisite ready, BuddyPress / bbPress / WooCommerce login hooks, No core-file changes, All features free
Frequently asked questions
I locked myself out. Now what?
Rename the plugin folder in /wp-content/plugins/ via FTP or your host’s file manager. Your default wp-login.php works again immediately — because nothing on disk was ever changed.
Does it work with caching plugins?
Yes — just make sure your custom login URL isn’t cached as a static page. Most caching plugins exclude login pages automatically.
Is any of my data sent to third parties?
By default, no — everything stays on your server. The only exception is the optional CAPTCHA feature: enable it, and challenge responses (plus the visitor IP) are verified with your chosen provider. Leave CAPTCHA off to make zero external calls.
Will hiding the URL alone protect me?
It stops the automated flood, which is most of the problem — but it’s one layer, not the whole defense. Turn on 2FA and brute-force lockouts too. That combination is the point of the plugin.
Close the door the bots are counting on
Hide your login, lock down WordPress, and see every attempt — all in one free, privacy-friendly plugin.
No comments yet. Be the first.