The same two addresses, on every WordPress site, forever
/wp-admin and /wp-login.php are two of the most-guessed web addresses on the entire internet — not because attackers are especially clever, but because every default WordPress installation uses the exact same login path. A tool built once to try usernames and passwords against that address works against every WordPress site that hasn’t changed it, which is most of them. That’s why these two URLs see automated traffic around the clock, regardless of how small or unknown your site is.
Why WordPress doesn’t just fix this by default
It’s a fair question: if this address is so predictable, why doesn’t WordPress just randomize it for everyone? The honest answer is that changing it isn’t free. Plugins, bookmarks, support documentation, and countless tutorials across the entire WordPress ecosystem all assume the login page lives at that familiar address. Making every site’s login location unpredictable by default would break a lot of things that currently just work. So it stays as a choice site owners can opt into, rather than something WordPress can safely force on everyone.
What moving your login page actually does — and doesn’t do
This is the part worth being honest about, because it’s easy to oversell: changing your login address to something custom won’t stop someone who’s specifically targeting your site and already knows (or can find) where you moved it to. It’s not a lock against a determined, specific attacker.
What it does extremely well is remove you from the pool of sites that generic, automated bots can reach with zero effort. Those bots aren’t looking for your site specifically — they’re scanning the default address across huge numbers of domains, and a site that’s moved its login page simply isn’t there to find. The practical benefit is twofold: you stop absorbing the bulk of that automated traffic, and whatever real, meaningful activity does show up in your logs becomes much easier to actually notice, instead of being buried under thousands of routine, automated login attempts.
Pair it with something that slows down repeated attempts
Moving the login URL and limiting how many login attempts an IP address can make in a short window work well together — one reduces the volume of automated noise, the other blocks whatever gets through anyway, including attempts aimed at wherever you moved the login page to. Neither replaces a strong password or two-factor authentication; they sit alongside those, cutting down the sheer number of attempts an attacker (automated or not) gets to make.
Where this lands in the free plugin
A custom login URL and login-attempt protection are both part of Loyal Security’s free feature set — no paywall, no trial window. If you’d rather not configure this yourself, the WordPress.org listing has the details.
Loyal Security — Firewall & Malware Scanner
Free on WordPress.org: firewall, malware scanning and login protection in one plugin. Upgrade to Pro for threat intelligence, Sentinel and uptime monitoring.