Your secret address is the only place anyone can sign in to your site once Login Guard is on. Choose it once, bookmark it, and you are done.
Where to set it:
Open AiX Login Guard, then the Settings tab. In the Your login address section, type your address in the Sign in at box and press Save settings. Your site's own address is printed in front of the box, so you can see the full address as you type.
- With normal "pretty" permalinks, your login is yoursite.com/your-address/
- If your permalinks are set to Plain (in Settings, then Permalinks), your login is yoursite.com/?your-address and the Settings screen shows the ? in front of the box for you
How your address is tidied:
Use letters, numbers and dashes. Login Guard tidies what you type the same way WordPress tidies a page address: capital letters become small letters, spaces become dashes and most other symbols are dropped. So My Secret Login is saved as my-secret-login.
The rules Login Guard checks:
Before an address is saved, Login Guard checks it. If there is a problem, a warning says Not saved: followed by the reason.
- At least 4 characters. Otherwise: Use at least 4 characters, so it cannot be guessed in a few tries.
- Not an address WordPress already uses. These are refused: wp-admin, wp-login, wp-login-php, login-php, wp-content, wp-includes, wp-json, wp-signup, wp-signup-php, wp-register, wp-register-php, wp-activate, wp-cron, feed, rss, rss2, atom, rdf, comments, page, embed, search, author, category, tag, type, xmlrpc, xmlrpc-php, sitemap, robots-txt, index-php and trackback, plus anything containing wp-login or wp-admin. The message is: WordPress already uses that address. Pick another.
- Not one of the addresses a robot tries first, because those would hide nothing. These are refused: login, log-in, logon, log-on, signin, sign-in, signon, sign-on, signup, sign-up, register, admin, administrator, admin-login, login-admin, adminlogin, wpadmin, wplogin, wp-admin-login, dashboard, backend, cpanel, user, users, user-login, userlogin, account, my-account, myaccount, secure, secure-login, my-login, mylogin, members, member-login, site-login, hidden-login, secret-login, my-secret-login, wordpress and wp. The Settings screen lists the main ones under the box. The message is: That is one of the first addresses a robot tries, so it would hide nothing. Pick something only you would think of.
- Not the address of a page or post on your site. Otherwise: A page or post on your site already has that address. Pick another.
- Not the address of your "forgot where to sign in?" page (login-help unless you changed it). Otherwise: That is the address of the "email me my login address" page. Pick another.
When an address is refused, nothing on that form is saved, so fix the address and press Save settings again.
Picking a good one:
Choose something you will remember and a robot will not guess. Avoid obvious words like login or your site name. The example shown in the empty box, my-secret-login, is refused too. Something like back-door-2718 or a short phrase that means something only to you works well.
After you save:
A message says Saved. You now sign in at, followed by your new address, and that it has been emailed to every administrator. From that moment, wp-login.php stops answering and your new address shows the login form. Bookmark it straight away. If you save without changing the address in use, the message just says Settings saved and nobody is emailed.
Changing it later:
- Type the new address in Sign in at.
- Press Save settings.
- Login Guard asks first: Change your login address? From the moment you save, you sign in at the new address and the old one stops working. The new address is emailed to every administrator straight away.
- Press Yes, change it.
Administrators are emailed only when the address really changes.
The old address becomes an ordinary missing page. Every administrator gets an email with the subject Your login address for (your site name) has changed. Tell anyone else who signs in to your site, such as editors or members, and update your bookmarks.
Can I empty the box to stop hiding my login?
Leaving the box empty the very first time changes nothing: your login stays at wp-login.php. But once you have an address and Hide my login is on, the box cannot be saved empty. Login Guard answers Not saved: The login address cannot be empty while "Hide my login" is on. To use the normal WordPress login again, switch Hide my login off instead. Your address is kept for later. See The Hide My Login Switch. To remove Login Guard completely, deactivate the plugin (see Deactivating Or Deleting Login Guard Safely).