Hidden WP Login

The standard WordPress login page looks the same on every site, and it’s an easy place for strangers to try passwords. Hidden WP Login lets you hide wp-login.php: anyone who opens it is sent to your Ultimate Membership Pro login page instead. Your members only ever see one branded login form.

Need the WordPress login page yourself? Add your IP address to the allow list and it still opens for you.

Hide wp-login.php behind your member login

• One login page for everyone. Requests for the WordPress login page go to the Login Page you set in Ultimate Membership Pro.
• Lost-password visits too. The lost-password address of wp-login.php also leads to your membership login page.
• An allow list for your team. Visitors from listed IP addresses still reach the WordPress login page, with no redirect.
• Whole ranges in one entry. End an address with * to allow every address that starts with it, such as an office network.
• Admins land on the dashboard. Administrators log in on the membership login page and go straight to the WordPress dashboard.

How Hidden WP Login works

1. Make sure a Login Page is set in your Ultimate Membership Pro pages.
2. Switch on the add-on.
3. Add your own IP address, and any others that should keep the WordPress login page.
4. Save. Visitors from other addresses who open wp-login.php are sent to your member login.

Step-by-step setup is in the Hidden WP Login guide.

When hiding the WordPress login page helps

• A branded login experience. Members never meet the default WordPress screen, only the login form you set up in Ultimate Membership Pro.
• Less exposure for wp-login.php. Strangers who open the standard address see your member login instead of the WordPress screen.
• One door for two-factor logins. Visitors log in through the membership form, which is where Two-Factor Authentication asks for its code.
• Staff keep their usual route. Your office address stays on the allow list and opens wp-login.php as before.

For example, a coaching club adds its office address, 203.0.113.25, to the allow list. The office keeps using wp-login.php, while every other visitor is sent to the Member Login page.

Works well with

• Two-Factor Authentication, to ask for a one-time code on the login form your visitors now use.
• Registration and login, the login and registration forms your visitors are sent to.
• Login security, for the other ways Ultimate Membership Pro protects member accounts.

Questions about Hidden WP Login

Which plans include Hidden WP Login?

Hidden WP Login comes with the Full Package and Agency plans, together with all 46 Pro add-ons. The Pro plan doesn’t include Pro add-ons.

Where are visitors sent?

To the page you chose as Login Page in your Ultimate Membership Pro pages setup. It shows your membership login form.

Can I still use the WordPress login page?

Yes, from any IP address on your allow list. Separate addresses with commas, or end one with * to allow a whole range.

Where do administrators land after logging in?

On the WordPress dashboard. They log in on the membership login page, and WordPress takes them straight to the admin area.

Does the lost-password link on my login form still work?

Yes. The Lost your password? link on your membership login form goes to your lost-password page, as before.