Basic, Free
Custom login and admin URLs for 1 site. Move your login off the default path and send bots a 404 yourself.
Hide WP
Move your WordPress login off /wp-login.php and cut automated attacks.
Hide WP changes your default wp-login.php and wp-admin URLs to custom paths, so automated bots and brute-force scripts targeting the well-known login URL get a 404 instead of your login form, applied consistently across every site you manage.
In short
Hide WP is a WP Tailwatch feature that changes your default wp-login.php and wp-admin URLs to custom paths across all your connected sites. Automated bots and brute-force scripts that only know the well-known login URL get a 404 instead of your login form, cutting a large share of automated attack traffic before it ever reaches you.
404
Allowed
Hidden
Notified
What it does
Hide the door the bots are pounding on.Your login stops answering at the obvious URL.
Every WordPress site ships its login at /wp-login.php, and automated scripts know it. Hide WP moves that door to a path only you know, so the bots knock on an empty wall.
- Changes the default wp-login.php URL to a custom path
- Moves the wp-admin dashboard behind a custom URL
- Returns a 404 to bots hitting the well-known login URL
- Applies one login-URL policy across every connected site
How it works
From open target to hidden door.Set a custom path and the old one returns a 404.
Pick new login and admin paths, WP Tailwatch applies them across every connected site, and bots hitting the default URLs get nothing.
1
Pick a custom path
Choose new URLs for your login and admin area, something only your team knows. WP Tailwatch stores them so you always know where to sign in.
2
Lock the old URL
Requests to /wp-login.php and the default /wp-admin return a 404, so automated scripts targeting the well-known login URL never reach a working form.
3
Apply, manage, get alerted
Push the same login-URL policy to every connected site, manage paths from one dashboard, and get a push alert when blocked login attempts spike.
Why it matters
Why hiding the login URL matters.Bots can't attack a page they can't find.
Brute-force attacks against the default WordPress login are relentless. Because virtually every WordPress site keeps its login at /wp-login.php, that URL is the single most-targeted endpoint on the web, automated scripts generate billions of brute-force login attempts against WordPress sites, guessing usernames and passwords around the clock. Source: Wordfence threat intelligence reports. Most of that traffic only works because the attacker already knows exactly where to knock.
Hide WP takes that knowledge away. Move the login and admin URLs to custom paths and the bots hitting the old well-known address get a 404, never reaching a form to attack. That is the WP Tailwatch difference: protection built in, instead of one more plugin to bolt on.
Plan availability
Free hiding, more power on paid.Protect one site, then roll it out everywhere.
Start moving your login URL for free, upgrade for alerts and scale.
Business, Alerts
Full Hide WP with login-attempt push alerts for 1-20 sites. Know the moment blocked login probes spike.
Agency, At scale
Manage custom login URLs across 21-1,000 sites with tiered volume pricing and one dashboard for everything.
Works together with
Part of your mobile-first stack.One platform in place of separate plugins.
Hide WP pairs with the rest of WP Tailwatch to replace 50+ separate plugins.
FAQ
Hide WP questions.Answers on custom paths, links, and lockouts.
Common questions about moving your WordPress login and admin URLs with WP Tailwatch.
Hide WP changes your default wp-login.php and wp-admin URLs to custom paths you choose. Automated bots and brute-force scripts that target the well-known login URL get a 404 instead of your login form, applied consistently across all your connected sites.
Almost every automated attack assumes your login lives at /wp-login.php. By moving it to a custom path, the bots hammering that well-known URL hit a 404 and never reach a login form, which cuts a huge share of automated brute-force traffic before it starts.
Hide WP dramatically reduces automated brute-force traffic by hiding the login URL from bots that only know the default path. It works best layered with login limiting and two-factor authentication, so a determined attacker who finds the new URL still hits additional defenses.
No. You choose the custom login path and use it to sign in. WP Tailwatch stores and manages your login URLs, so you always know where to log in, and you can update the path at any time from the dashboard or mobile app.
Yes. WP Tailwatch is multi-site by design, so you can set and manage custom login and admin URLs across every connected WordPress site from a single dashboard and the mobile app, instead of editing each site separately.
On paid plans, WP Tailwatch can send a push alert to your phone when blocked login attempts spike, so you know when your sites are being probed even though the bots are getting 404s at the old login URL.
Yes. Custom login and admin URLs are available on the free Basic plan for one site. Paid Business and Agency plans add login-attempt push alerts and managing custom URLs across many sites from one place.
Yes. Hide WP is one of the tools that lets WP Tailwatch replace 50+ separate plugins. Instead of installing a standalone hide-login plugin on every site, custom login URLs are built into the same platform that handles your security, backups, and monitoring.
Take the target off your login page.
Move wp-login and wp-admin to custom paths, send brute-force bots a 404, and manage every site from one dashboard. Start free today.
- Free forever plan
- No credit card
- 14-day money-back on paid plans