/ Plugin Category

/ Security & Privacy

/ Security Scanning & Malware Protection

/ WPS Hide Login

WPS Hide Login

By Remy Perona

Security & Privacy / Security Scanning & Malware Protection

Reviewed by Omar Dabbas

Trusted WordPress expert with 20+ years of experience evaluating plugins for the WP ecosystem.

WPS Hide Login Review - In-Depth Analysis

Easily change the URL of your WordPress login page to enhance security.

Performance Overview

WPS Score

7.56/10

User Rating

4.8/5 (based on 2111+ reviews)

Active Installations

2,000,000+

Update Frequency

Average It is calculated using the weighted average of same category plugins.

Security Score

5.63 / 10 (Medium Risk) It is calculated using the weighted average of all versions.

What It Does

The WPS Hide Login plugin allows you to change the default login URL of your WordPress site to anything you want. This enhances security by making it harder for unauthorized users to access the login page. It does not modify core files or add rewrite rules, ensuring a smooth operation.

When activated, the wp-admin directory and wp-login.php page become inaccessible. Remember to bookmark or note the new login URL. Deactivating the plugin restores the original login functionality.

This plugin is compatible with multisite installations, allowing individual sites to rename their login pages as needed. It works seamlessly with various plugins that interact with the login form, ensuring a reliable user experience.

Comparing to Alternatives

WPS Hide Login is one of the most widely used login-masking plugins, but it competes in a crowded field of similar tools that offer comparable functionality, and in some cases, additional security layers.

Top alternatives

Strengths

Extremely simple setup with a single field to change the login URL
Lightweight, with minimal impact on site performance
Long track record and huge install base with a very high average rating
Effective at cutting down automated brute-force noise for most users

Weaknesses

Multiple past vulnerabilities, including a critical one, show a history of disclosure issues
Does not address xml-rpc based login attempts, leaving a known bypass
Some competing plugins (like WP Hide & Security Enhancer or WP Ghost) bundle broader security or firewall features beyond simple URL masking

User Sentiment Analysis

With 94.1% of ratings at 5 stars and only 3.3% in the 1-2 star range, sentiment is overwhelmingly positive. Most users report a smooth setup and a noticeable drop in bot login attempts, though a small but vocal minority report site-breaking conflicts or doubt the plugin's real security value.

Positive highlights

"So Easy, Perfect Results... Not a single hack!" — stephgphotos
"Easy plugin that should be on a starter pack to hide your login from bots. Seems light and easy." — Jason Ball
"After installing the plug-in, it worked great" — Jon Guild
"Excelent !!" — redee

Common complaints

Belief that hidden login URLs are quickly rediscovered by crawlers and bots, making the protection largely a false sense of security
Custom login URL redirecting to a 404 error, locking admins out of their own site
Plugin leaving the admin bar visible and preventing logout, combined with 404 redirects on both the default and custom login URLs (reported with Oxygen Builder/no-theme setups)

Weaknesses

History of seven known vulnerabilities, including one rated critical and two rated high/medium, though all have been patched
Does not block xml-rpc login attempts, so determined attackers can still probe login functionality
A minority of users report the plugin breaking site access entirely, particularly with certain themes or builders

Who Should Use This?

Best for

Site owners looking for a quick, free, and simple way to reduce automated brute-force noise on the default wp-login.php and wp-admin URLs will find this plugin does exactly what most people expect, with minimal configuration.

Not ideal for

Users seeking robust security against determined attackers should look elsewhere or pair this plugin with additional protections, given its patched-but-repeated vulnerability history and the fact that it doesn't stop xml-rpc based attacks. Those running non-standard theme setups (like headless or builder-based themes) should also test carefully, as some users report lockouts or 404 issues after activation.

Pricing & Value

Free version includes

The free version includes the plugin's full core functionality: changing the login page slug, redirecting the default wp-login.php and wp-admin URLs, and basic customization of redirect behavior. This covers the entire feature set most users need.

Final Verdict

WPS Hide Login remains a popular choice for a reason: it's free, easy to configure, and does noticeably cut down on automated login attempts for the vast majority of users, as reflected in its 4.8-star average across over 2,000 ratings. However, the plugin's vulnerability history, including a critical-severity issue in the past, and repeated disclosure-related CVEs suggest that login URL masking should be treated as a minor deterrent rather than a genuine security barrier.

Compared to the many alternatives in this space, WPS Hide Login's main advantage is its simplicity and adoption, not necessarily best-in-class security. Users who want just URL obscurity will be satisfied, but those seeking real protection should combine it with two-factor authentication, xml-rpc disabling, and monitor for the occasional compatibility issues reported with certain themes or page builders.

Other Notable Features

Here are a few other notable features of this free WPS Hide Login plugin.

Custom Login Url

Rename

Screenshots

FAQ

Either go to your MySQL database and look for the value of whl_page in the options table, or remove the wps-hide-login folder from your plugins folder, log in through wp-login.php and reinstall the plugin.

On a multisite install the whl_page option will be in the sitemeta table, if there is no such option in the options table.