Get Started

Replacing the WordPress login URLs

Send visitors to your own pages instead of wp-login.php — and know exactly what the redirect switch does.

  • Beginner
  • 6 min read
  • Applies to 2.0

Turn on the redirect

In the Login Page Manager, flip the switch in the Redirect column of the login row. The URL beside it is where visitors will land, so it doubles as a check that the right page is assigned.

The Redirect column, with the login row switched on and its URL beside it.

  • The login page exists and is published
  • The switch is on, and the URL beside it is the one you expect
  • Log out in a private window and open /wp-login.php — you should land on your page
  • Note your emergency access link somewhere outside the site, before you need it

Two mechanisms, not one

Knowing which is which saves a lot of guessing.

WordPress advertises your pages. As soon as a registration or lost-password page is assigned, every link WordPress prints for those flows points at your page — the links under the default form, anything a theme builds from register_url() or lostpassword_url(). This needs no switch: assigning the page is enough.

The switch intercepts the request. It applies to the login flow, and it does something stronger: a visitor who lands on wp-login.php is sent to your login page instead.

Only login intercepts. A visitor who types /wp-login.php?action=register directly still reaches the WordPress form.

What deliberately gets through

Interception has to have holes, or it locks people out. These reach wp-login.php even with the switch on:

  • logout — logging out has to work from anywhere
  • register, lostpassword, rp — the other three flows, which have their own pages
  • magic_login — Pro's magic link validates its one-time token on wp-login.php itself; redirecting would strip the token from the URL before it could be checked
  • Any POST request — a submission is handled first, and a redirect at that point would break it
  • A valid emergency access link — the reason it exists is to survive a login page that is broken or a method that has locked you out

wp-login.php is redirected, not disabled. This is branding, not a security measure: anyone who wants the classic form can still reach it through one of the paths above.

Related articles

Something missing or out of date? Tell support.