Hide Your WordPress Login URL with HSArticle Login Warden
Stop bots from finding your WordPress login page, and stop them from confirming your usernames even if they do. HSArticle Login Warden lets you set a custom login URL in seconds, then quietly shuts the other three doors most “hide login” plugins forget about: XML-RPC, author enumeration links, and the REST API users endpoint. No file edits, no rewrite rules, just a settings page and a handful of toggles.
Why you need to hide your WordPress login URL
Every WordPress site ships with the same login URL: wp-login.php. Bots scan for it constantly. Changing it is the single easiest way to cut brute-force attempts overnight – but most plugins that hide your WordPress login URL stop there, while your usernames still leak out through XML-RPC, ?author=1 links, and the REST API.
HSArticle Login Warden closes all four doors, not just one. It doesn’t rename core files or add rewrite rules – it simply intercepts requests to the old login URL and /wp-admin and shows a 404 (or redirect) to logged-out visitors, while your custom URL loads the real login form.
Features
01
Custom login URL
- Set any login slug you want
- Choose what logged-out visitors see at the old URL: a 404, a redirect home, or a redirect anywhere you choose
- Your current login URL is always visible on the settings page with a one-click Copy button
- Built-in conflict check so your slug never collides with an existing page or post
02
Optional hardening toggles
- Disable XML-RPC — a forgotten login door and common brute-force target
- Generic login error messages — stops WordPress confirming whether a username exists
- Block username enumeration via
?author=1,?author=2, etc. - Hide
/wp-json/wp/v2/usersfrom logged-out requests
Every toggle only affects logged-out visitors. Nothing is tracked, logged, or stored. Deactivate the plugin and your site instantly returns to default.
How to hide your WordPress login URL (step by step)
- Go to Plugins → Add New
- Search “HSArticle Login Warden”
- Install and activate
- You’ll land on Settings → HSArticle Login Warden — set your login URL and save
- Bookmark your new login URL before logging out
Frequently Asked Questions
I forgot my login URL.
Check the hsarlowa_settings row in wp_options, or deactivate the plugin via FTP to restore wp-login.php.
Does it work with caching plugins?
Yes — just exclude your new login URL from the cache, same as any dynamic page.
Will disabling XML-RPC break anything?
It stops the old XML-RPC mobile apps and some legacy Jetpack features. Most modern setups using the REST API are unaffected.
Will blocking ?author= links break my author pages?
No. Only the numeric query string is blocked. Pretty permalinks (/author/yourname/) work as normal.
Will hiding the REST users endpoint break the block editor?
No. /wp/v2/users/me is untouched — only the endpoint that lists every username is hidden.
What if I forget to bookmark the new URL?
Deactivate the plugin via FTP and it instantly restores wp-login.php.
Download HSArticle Login Warden Free WordPress Plugin
WordPress HSArticle Login Wardenis 100% free and open source. Download it directly from the official WordPress Plugin Directory.
