{"id":389282,"date":"2026-10-30T14:47:31","date_gmt":"2026-10-30T14:47:31","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/hide-login-url\/"},"modified":"2026-10-30T14:47:11","modified_gmt":"2026-10-30T14:47:11","slug":"vanishlogin","status":"publish","type":"plugin","link":"https:\/\/km.wordpress.org\/plugins\/vanishlogin\/","author":23352743,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.2","stable_tag":"1.0.2","tested":"7.1.4","requires":"5.8","requires_php":"7.4","requires_plugins":null,"header_name":"VanishLogin","header_author":"Md Jahid Bin Sabit","header_description":"Hide wp-login.php behind a stealth URL only you know. Intruders hitting the old login page get a 404, your homepage, or a custom destination. Small, fast, no bloat.","assets_banners_color":"2b3145","last_updated":"2026-10-30 14:47:11","external_support_url":"","external_repository_url":"","donate_link":"https:\/\/jbsabit.com\/","header_plugin_uri":"https:\/\/wordpress.org\/plugins\/vanishlogin\/","header_author_uri":"https:\/\/jbsabit.com\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":59,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.2":{"tag":"1.0.2","author":"jbsabit","date":"2026-10-30 14:47:11","revision":3775496}},"upgrade_notice":{"1.0.2":"<p>Adds the intruder IP log with one-click IP blocking, under the new VanishLogin name. Settings migrate automatically.<\/p>"},"ratings":[],"assets_icons":{"icon-256x256.png":{"filename":"icon-256x256.png","revision":3775496,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3775496,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3775496,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.2"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3775496,"resolution":"1","location":"assets","locale":"","width":1280,"height":960},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3775496,"resolution":"2","location":"assets","locale":"","width":1280,"height":960},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3775496,"resolution":"3","location":"assets","locale":"","width":1280,"height":960},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3775496,"resolution":"4","location":"assets","locale":"","width":1280,"height":960}},"screenshots":{"1":"Set your secret login URL and choose what intruders see on the old wp-login.php \u2014 a 404, your homepage, or a custom URL.","2":"Intruder IP log: every hit on your old login page, grouped by IP with hit counts \u2014 block any IP in one click.","3":"Bots get a 404 on wp-login.php. You get the real login form at your secret address.","4":"Never lock yourself out: the emergency bypass and your safety facts, always one screen away."}},"plugin_section":[],"plugin_tags":[3760,25642,1229,3990,6187],"plugin_category":[],"plugin_contributors":[287178,288804],"plugin_business_model":[],"class_list":["post-389282","plugin","type-plugin","status-publish","hentry","plugin_tags-custom-login-url","plugin_tags-hide-login","plugin_tags-login-security","plugin_tags-rename","plugin_tags-wp-login-php","plugin_contributors-jbsabit","plugin_contributors-wearereflecters","plugin_committers-jbsabit"],"banners":{"banner":"https:\/\/ps.w.org\/vanishlogin\/assets\/banner-772x250.png?rev=3775496","banner_2x":"https:\/\/ps.w.org\/vanishlogin\/assets\/banner-1544x500.png?rev=3775496","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/vanishlogin\/assets\/icon-256x256.png?rev=3775496","icon_2x":"https:\/\/ps.w.org\/vanishlogin\/assets\/icon-256x256.png?rev=3775496","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/vanishlogin\/assets\/screenshot-1.png?rev=3775496","caption":"Set your secret login URL and choose what intruders see on the old wp-login.php \u2014 a 404, your homepage, or a custom URL."},{"src":"https:\/\/ps.w.org\/vanishlogin\/assets\/screenshot-2.png?rev=3775496","caption":"Intruder IP log: every hit on your old login page, grouped by IP with hit counts \u2014 block any IP in one click."},{"src":"https:\/\/ps.w.org\/vanishlogin\/assets\/screenshot-3.png?rev=3775496","caption":"Bots get a 404 on wp-login.php. You get the real login form at your secret address."},{"src":"https:\/\/ps.w.org\/vanishlogin\/assets\/screenshot-4.png?rev=3775496","caption":"Never lock yourself out: the emergency bypass and your safety facts, always one screen away."}],"raw_content":"<!--section=description-->\n<p><strong>Hide your login page. Starve the bots.<\/strong><\/p>\n\n<p>Brute-force bots hammer <code>wp-login.php<\/code> on every WordPress site \u2014 thousands of password guesses a day, around the clock. They can only attack a door they can find. The simplest fix is to <strong>hide the login page<\/strong>: rename wp-login.php to a custom login URL that only you and your team know.<\/p>\n\n<p><strong>VanishLogin<\/strong> moves that door. Your login form lives at a <strong>custom login URL only you know<\/strong> (like <code>yoursite.com\/my-secret-door<\/code>), while the old <code>wp-login.php<\/code> stops answering anyone who is logged out. Your access logs go quiet, your server stops wasting resources on bot traffic, and password guessing has nowhere to land.<\/p>\n\n<p><strong>What it does<\/strong><\/p>\n\n<ul>\n<li><strong>Hide your login page<\/strong> \u2014 change wp-login.php to any secret slug, with live validation, a live URL preview, and one-click copy<\/li>\n<li><strong>Choose what intruders get<\/strong> \u2014 logged-out visitors hitting wp-login.php or wp-admin receive a <strong>404<\/strong>, your <strong>homepage<\/strong>, or a <strong>custom URL<\/strong> of your choice<\/li>\n<li><strong>Intruder IP log<\/strong> \u2014 every hit on the old login page, grouped by IP with hit counts and last-seen times; <strong>block or unblock any IP in one click<\/strong> (blocked IPs are refused everywhere, including the secret login URL \u2014 and you can never block your own IP)<\/li>\n<li><strong>Modern settings dashboard<\/strong> \u2014 protection status pill, blocked-intruder hit counter, and your full login URL at a glance<\/li>\n<li><strong>Never get locked out<\/strong> \u2014 a one-line emergency bypass in wp-config.php disables protection instantly, and logged-in users are never blocked<\/li>\n<li><strong>Plays well with others<\/strong> \u2014 password reset, logout, registration, and re-auth links keep working; pairs perfectly with 2FA and limit-login-attempts plugins<\/li>\n<\/ul>\n\n<p><strong>How it works<\/strong><\/p>\n\n<ol>\n<li>Turn protection on and pick your secret slug.<\/li>\n<li>Share the new login URL with your team \u2014 bookmark it.<\/li>\n<li>Bots keep knocking on wp-login.php and get a 404. You log in at your secret address like always.<\/li>\n<\/ol>\n\n<p><strong>Built like a security tool should be<\/strong><\/p>\n\n<ul>\n<li>Small codebase, no tracking, no telemetry, no upsells \u2014 100% free under the GPL<\/li>\n<li>Nothing leaves your server; the intruder log is stored in your own database<\/li>\n<li>Honest about its layer: hiding the login page removes the target, and pairs with 2FA and login-attempt limiting for defense in depth<\/li>\n<\/ul>\n\n<p>Built by WordPress security specialist Md Jahid Bin Sabit.<\/p>\n\n<h3>Credits<\/h3>\n\n<p>VanishLogin is designed, built, and maintained by <strong>Md Jahid Bin Sabit<\/strong> \u2014 WordPress security specialist.<\/p>\n\n<ul>\n<li>Website: https:\/\/jbsabit.com\/<\/li>\n<li>WordPress.org profile: https:\/\/profiles.wordpress.org\/jbsabit\/<\/li>\n<li>Contributor: Reflecters \u2014 https:\/\/profiles.wordpress.org\/wearereflecters\/<\/li>\n<\/ul>\n\n<!--section=installation-->\n<ol>\n<li>Upload the plugin files to <code>\/wp-content\/plugins\/vanishlogin\/<\/code>, or install through the WordPress plugins screen.<\/li>\n<li>Activate the plugin.<\/li>\n<li>Go to <strong>Settings \u2192 Stealth Login<\/strong>, turn protection on, and choose your secret login slug.<\/li>\n<li>Log out and test: your new URL shows the login form, while wp-login.php returns a 404.<\/li>\n<\/ol>\n\n<p><strong>Locked out?<\/strong> Add <code>define( 'VANISH_BYPASS', true );<\/code> to wp-config.php to temporarily disable protection.<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"how%20do%20i%20hide%20my%20wordpress%20login%20page%3F\"><h3>How do I hide my WordPress login page?<\/h3><\/dt>\n<dd><p>Install VanishLogin, turn protection on under <strong>Settings \u2192 Stealth Login<\/strong>, and choose a secret slug. Your login form moves to <code>yoursite.com\/your-slug<\/code>, and the old wp-login.php stops answering logged-out visitors.<\/p><\/dd>\n<dt id=\"how%20do%20i%20change%20or%20rename%20the%20wp-login.php%20url%3F\"><h3>How do I change or rename the wp-login.php URL?<\/h3><\/dt>\n<dd><p>That is exactly what VanishLogin does \u2014 it lets you rename wp-login.php to anything you want: any custom login URL you choose, with live validation so you cannot pick a slug that clashes with an existing page. All core links (lost password, logout, register) are rewritten to the new address automatically.<\/p><\/dd>\n<dt id=\"what%20happens%20when%20someone%20visits%20wp-login.php%3F\"><h3>What happens when someone visits wp-login.php?<\/h3><\/dt>\n<dd><p>You choose: a 404 \"page not found\", a quiet redirect to your homepage, or a redirect to any custom URL. Every hit is recorded in the intruder IP log either way.<\/p><\/dd>\n<dt id=\"can%20i%20block%20an%20ip%20that%20keeps%20probing%20my%20login%20page%3F\"><h3>Can I block an IP that keeps probing my login page?<\/h3><\/dt>\n<dd><p>Yes. The intruder IP log groups every hit on the old login page by IP, with hit counts and last-seen times. One click blocks an IP everywhere \u2014 even on your secret login URL \u2014 and one click unblocks it. You can never block your own IP.<\/p><\/dd>\n<dt id=\"will%20i%20get%20locked%20out%20of%20my%20own%20site%3F\"><h3>Will I get locked out of my own site?<\/h3><\/dt>\n<dd><p>No. The plugin never blocks logged-in users, and an emergency bypass constant (<code>VANISH_BYPASS<\/code>) in wp-config.php disables protection instantly if you ever forget your slug.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%202fa%20or%20limit-login-attempts%20plugins%3F\"><h3>Does it work with 2FA or limit-login-attempts plugins?<\/h3><\/dt>\n<dd><p>Yes. VanishLogin only changes where the login form lives and blocks the old address \u2014 authentication itself is untouched, so 2FA and login-attempt limiters keep working. The combination is stronger than either alone: bots cannot find the form, and attempts on the real form are limited.<\/p><\/dd>\n<dt id=\"what%20happens%20to%20password%20reset%20and%20logout%20links%3F\"><h3>What happens to password reset and logout links?<\/h3><\/dt>\n<dd><p>They keep working. The plugin rewrites wp-login.php links (lost-password, logout, register) to your secret URL automatically.<\/p><\/dd>\n<dt id=\"does%20hiding%20wp-login.php%20replace%20other%20security%3F\"><h3>Does hiding wp-login.php replace other security?<\/h3><\/dt>\n<dd><p>No \u2014 it is one strong layer. It removes the most-attacked target on your site; pair it with 2FA, login-attempt limiting, and regular updates for defense in depth.<\/p><\/dd>\n<dt id=\"will%20vanishlogin%20slow%20down%20my%20website%3F\"><h3>Will VanishLogin slow down my website?<\/h3><\/dt>\n<dd><p>No. It adds no scripts or styles to your public pages and makes no external requests. Its checks run only on login-related requests.<\/p><\/dd>\n<dt id=\"can%20search%20engines%20still%20find%20my%20login%20page%3F\"><h3>Can search engines still find my login page?<\/h3><\/dt>\n<dd><p>Your secret URL is never linked anywhere public, and blocked addresses return 404 \u2014 nothing for crawlers to index.<\/p><\/dd>\n<dt id=\"is%20vanishlogin%20really%20free%3F\"><h3>Is VanishLogin really free?<\/h3><\/dt>\n<dd><p>Yes \u2014 100% free, GPL-licensed, no premium version, no upsells, no locked features.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.2<\/h4>\n\n<ul>\n<li>NEW: Intruder IP log \u2014 hits on the old login page are grouped by IP with hit counts, and any IP can be blocked\/unblocked with one click (blocked IPs are refused everywhere, including the secret login URL; you can never block your own IP).<\/li>\n<li>Renamed to VanishLogin (new slug <code>vanishlogin<\/code>) with a distinctive <code>vanish_<\/code> code prefix throughout; settings migrate automatically from the previous release.<\/li>\n<\/ul>\n\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>Fixed Plugin URI header (now points to the wordpress.org plugin page) \u2014 required by the WordPress.org submission validator.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release: custom secret login URL, wp-login.php and wp-admin guards, intruder 404\/homepage\/custom-URL handling, blocked-hit counter, modern settings UI with live preview, emergency bypass.<\/li>\n<\/ul>","raw_excerpt":"Hide your login page: change wp-login.php to a secret custom login URL only you know. Bots get a 404, and every intruder hit is logged by IP.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/km.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/389282","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/km.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/km.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/km.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=389282"}],"author":[{"embeddable":true,"href":"https:\/\/km.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/jbsabit"}],"wp:attachment":[{"href":"https:\/\/km.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=389282"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/km.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=389282"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/km.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=389282"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/km.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=389282"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/km.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=389282"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/km.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=389282"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}