Every bot on the internet knows where your login page is
Every WordPress site has its login page at /wp-login.php or /wp-admin. Every brute-force bot knows this. They hammer those URLs with thousands of password attempts per day, burning server resources and filling your security logs.
Strong passwords protect you from unauthorized access, but they don't stop the bots from trying. Every failed attempt is a PHP request that consumes CPU and database queries. On shared hosting, this can measurably slow your site.
What most people do instead
A better way: move the login page in one command
Open the navigator. Type hide login -slug=manage. Your login page moves from /wp-login.php to /manage. Anyone hitting the old URL gets a 404. Bots can't find what doesn't exist.
Emergency recovery built in. If you forget your custom URL, TrueCommander generates a secret recovery token on activation. You can always get back in.
How it works
hide login -slug=manage moves the login to /manage. Validates against reserved paths and existing pages./wp-login.php and /wp-admin return 404 for non-logged-in visitors. Bots find nothing.hide login -disable restores the default login URL. Rewrite rules flush automatically.| Detail | Value |
|---|---|
| Command name | hide login |
| Set custom URL | -slug=manage (min 3 characters) |
| Disable | -disable restores /wp-login.php |
| Check status | hide login (no flags) |
| Blocked slugs | wp-admin, wp-login, admin, login, feed, sitemap, and other reserved paths |
| Page conflict | Rejects slugs that match published page URLs |
| Can be used in |
Real example
You check your server access logs and see 3,000 failed login attempts in the last week — all from bots hitting /wp-login.php. Your shared hosting provider sent a warning about CPU usage.
You open the navigator and type hide login -slug=team-portal. The login page moves. You bookmark the new URL and share it with your team.
Next week, the access logs show zero hits on /wp-login.php — they all return 404 before WordPress even loads. The brute-force attempts dropped to zero because there's nothing at the URL bots expect. Server CPU usage drops. Hosting provider stops complaining.