Why you should not rename wp-login.php and how to recover access

Withdrawn procedure. Do not rename, copy or edit wp-login.php, and do not block the core file with rules that stop it working. WordPress restores it when updating, and these changes can break login, integrations, password recovery and future updates.

Recommended protection

• Keep WordPress, plugins and themes up to date and remove components that are no longer maintained.
• Enable two-factor authentication for all administrators and use unique passwords with a password manager.
• Apply login attempt limiting, an application firewall and brute-force protection; do not rely only on hiding a URL.
• If you want to change the login path, use a maintained, compatible plugin without touching the core. See Protect wp-admin and wp-login with the WPS Hide Login plugin.
• Keep a tested recovery method and make a backup before changing authentication.

Changing the URL reduces automated noise, but it does not fix vulnerabilities or replace 2FA, updates and access limiting.

If you have already followed an old guide

Keep a copy of the changes and identify the installed WordPress version. Recover the original file from an official distribution of that same version and review the rules or references you added to use the alternative name. Do not download a standalone wp-login.php from an unknown website.

Test logging in and password recovery with the restored core. Once they work, replace the manual change with compatible controls. If there was an intrusion, the WordPress clean-up must cover more than that file.