Smart Protector is a security plugin for WordPress, the popular content management system. It makes it harder for the wrong people to reach your site’s dashboard. It is built by BeeClear, a developer of WordPress plugins and smartphone apps. One of its features moves the login screen to an address you choose and hides the standard /wp-login.php. Changing the WordPress login URL looks like a small tweak, yet it is easy to get wrong in ways that give the new address away or lock the administrator out. Here are eight common mistakes and how the plugin prevents each one.
Table of contents
- Why is redirecting /wp-login.php to the homepage a mistake?
- Does a guest visiting /wp-admin reveal your new login URL?
- What happens to password reset links after the change?
- Why must the login slug not match an existing page?
- How do you avoid locking yourself out after hiding the login screen?
- Why should a login redirect never leave your own site?
- Do you need to edit .htaccess to hide wp-login.php?
- Can the login screen at the new address end up in search results?
- How do you move the login screen safely on your own site?
Why is redirecting /wp-login.php to the homepage a mistake?
Redirecting /wp-login.php to the homepage is a mistake because every bot visit then costs a full page render. Bots will keep hitting that file regardless, so the server does a lot of pointless work. Smart Protector answers such requests with a 404 by default, and the settings label that option as recommended. The response is raised early in the request, without loading the theme. It is the cheapest possible reply to traffic you cannot avoid.
Here is how the three options under “When /wp-login.php is requested” compare:
| Option | What the visitor gets | Cost to the server |
|---|---|---|
| Return 404 (recommended) | a “not found” page | lowest, no theme rendered |
| Redirect to homepage | a redirect to the homepage | a full homepage render |
| Redirect to custom URL | a redirect to a path on this site, e.g. /welcome/ | a render of the target page |
Does a guest visiting /wp-admin reveal your new login URL?
A guest visiting /wp-admin reveals your new login URL on an unprotected WordPress site. WordPress core sends a logged-out visitor straight to the sign-in form. Hiding the slug is pointless if typing /wp-admin gets anyone there. Smart Protector has a separate setting for this, “When a guest visits /wp-admin”. The guest gets one of three answers: the same as for /wp-login.php, a redirect to the homepage, or a redirect to a path you pick. None of them exposes your real address.
The rule is precise. The plugin compares the request with the site’s actual admin path, so a post at /blog/wp-admin-tips/ is not mistaken for a dashboard hit. Subdirectory installs are handled correctly too. It also leaves admin-ajax.php, async-upload.php and admin-post.php alone. Those endpoints serve logged-out traffic and issue their own redirects, so a form submitted by a guest does not suddenly land on the homepage.
What happens to password reset links after the change?
Password reset links keep working after the change, even though many people assume they will break. A reset link points to /wp-login.php with the reset key in its parameters. Smart Protector forwards it to your custom login address and keeps both the key and the username. Emails already sitting in inboxes stay valid. Requests for a new password and the confirmation screen are forwarded the same way.
The second trap is links in your theme and other plugins. Smart Protector rewrites the sign-in, logout, registration and lost-password links that WordPress functions generate. A “Log in” button built on those functions points to the right place straight away. A link hard-coded as /wp-login.php, however, gets whatever response the hiding setting defines.
Why must the login slug not match an existing page?
The login slug, the last part of the URL that opens the sign-in form, must not match an existing page because it would hide that page. By default the slug is “login”, so the form lives at /login/. The plugin’s rewrite rule takes priority over content at the same address. Smart Protector checks your posts and pages on save and, on a clash, warns you with the slug and the title of the affected content.
The plugin also keeps the slug itself in shape. It sanitises the value into a URL-safe form, and an attempt to use “wp-login” is turned into “login”. Below the field you see the current sign-in address as a clickable link. You can test it with one click before you log out.
How do you avoid locking yourself out after hiding the login screen?
Locking yourself out after hiding the login screen usually happens to whoever did not save the new address before logging out. Bookmark it right after you save the settings. Smart Protector reminds you with a one-time notice after activation that shows the exact sign-in URL. The notice also appears when the plugin picks up settings left in the database by an earlier installation. No administrator gets surprised by a slug they never chose.
If the address still goes missing, you have not lost the site for good. There are three ways back:
- read the current slug from the plugin’s option with WP-CLI, without switching anything off,
- turn hiding off with a single WP-CLI command, and /wp-login.php accepts sign-ins again,
- rename the plugin folder over SFTP, and the standard form comes back immediately.
Why should a login redirect never leave your own site?
A login redirect should never leave your own site, because your domain would then be sending traffic somewhere else. Since version 1.10.4, Smart Protector accepts only a path on this site in the “Redirect to custom URL” field, for example /welcome/. A value on another domain is rejected on save. It does not vanish silently: the settings screen shows an error naming the field and the rejected value, and a configuration import reports it the same way.
A full URL on your own domain used to be a trap as well. Opening the site under another host, such as a local address or a preview tunnel, broke that redirect. Visitors then landed on the admin URL instead of the page you chose. Now the plugin stores such a URL as a path and combines it with whatever domain the site is currently opened on.
Do you need to edit .htaccess to hide wp-login.php?
You do not need to edit .htaccess to hide wp-login.php, and hand-written server rules are easy to forget later. Smart Protector does not touch .htaccess, wp-config.php or your theme. It only reads and writes its own option, its own user meta and WordPress rewrite rules. When you change the slug, it refreshes those rules itself, so the new URL works at once.
That design has a practical upside. Deactivating the plugin brings the standard sign-in form back immediately, with nothing to clean up in the server configuration. Settings and secrets stay in place unless you ticked the option to delete all data.
Can the login screen at the new address end up in search results?
The login screen at the new address should not end up in search results, and Smart Protector tells crawlers so explicitly. It sends an X-Robots-Tag header with noindex and nofollow. It also adds no-cache headers, so the page is not kept in caches along the way.
The form gets more protection than that. An X-Frame-Options header blocks it from being embedded in a frame, which guards against clickjacking. Referrer-Policy, in turn, keeps the URL from leaking to other domains when someone follows an outbound link. The security checkpoint where you enter your 2FA code gets the same headers.
How do you move the login screen safely on your own site?
You move the login screen safely in “Smart Protector > Global settings”, on the “Login URL” card. Enter your own slug, keep the recommended 404 response and choose what a guest gets at /wp-admin. After saving, check that the plugin has not reported a clash with existing content. Bookmark the new address before you end your session. From then on, bots knock on a door that is not there.
A hidden sign-in form is one layer of protection, next to attempt limits and two-factor authentication. The Smart Protector plugin page describes every module. Get in touch and we will help you roll out the protection without the risk of locking yourself out.
