Moving the sign-in page

Off by default, and the screen is honest about what it is.

It does not make a password harder to guess. Anybody who reads the HTML of a page that links to the sign-in form, or watches one request go past, can find the new address. It is not a lock.

What it does is stop the traffic. Every WordPress site is asked for /wp-login.php a few thousand times a month by machines that found it by guessing the software. Move the door and nearly all of that arrives as a 404 instead of as a password check — measurable load off a small site, and a quieter log.

If you switch it on:

• the new address is shown on the screen and emailed to you the moment you save it;
• wp login-security door prints it from the command line;
• the recovery link above still opens the old address, from anywhere.

The moved page is WordPress's own sign-in page, with its forms working as they do at the old address. That includes the small sign-in box wp-admin shows when a session runs out, which closes itself once you have signed in.

Pick something that is not login, admin or wp-admin, since those are on the same lists the machines are already working through.