Hide My WP：Add-on WordPress 安全外掛 | 隱藏 wp-admin & 登入網址等 40 多項功能
Hide My WP（Hide My WordPress）能變更或隱藏 WordPress 的登入網址、wp-admin，以及佈景主題與外掛的路徑，憑這些主要功能與附加項目，可以歸入 WordPress 安全外掛的範疇。WordPress 的登入網址 wp-admin 是直接露在外面的，所以可以用加強防護的安全外掛把它藏起來。
其中 Hide My WP 是付費外掛，除了隱藏登入網址與 wp-admin，還支援變更佈景主題與外掛路徑、入侵偵測與 IP 封鎖、關閉 XML-RPC 等 40 多項功能。
1️⃣ Hide My WP 設定畫面
Hide My WP 外掛的 [Settings] 畫面分成 Start、Hiding、Permalinks、Protection、Cleanup、Replace 六個分頁。登入網址與隱藏設定在 [Hiding] 和 [Permalinks] 分頁，XML-RPC 在 [Cleanup] 分頁。
Hide My WP 設定模擬器
按 [See More] 會前往該紀錄清單。
每一列都可以按 [Exclude]、[Ban IP]、[Delete]、[Filter]。
可以用 [Whitelist this IP]、[Delete] 和 [Filter by Source] 變更清單。
[Feedback] 會前往開發商的外部藍圖網址，該網址顯示 [Page not found]。
[Manual Configuration] 會在新分頁開啟要手動加進 .htaccess 的規則。
每個欄位都可以修改，改好四個黃色欄位後按 [Save Settings]，下方未登入訪客的畫面就會跟著變。
管理後台 — Hide My WP › Settings
Item permanently deleted.%s items permanently deleted.Item added to the exceptions list.%s items added to the exceptions list.IP added to the block list.%s IPs added to the block list.IP added to the whitelist.%s IPs added to the whitelist.All logs have been deleted!Search results for “%s”1 item%s itemsPrevious settings have been restored!
Dashboard
Your website may be visible to hackers and detectors. Click on "Show Fixes" to fix 1 issues we have detected.
- Your full hide is disable, Wapplyzer will detect you are using WordPress.
12
Blocked Attack Chart
IDS Attack Blocked
| Name | Value | Impact / Total | IP | Date |
|---|---|---|---|---|
get-file | ../../../../etc/passwd | 25 / 50 | 198.51.100.44 | Oct 13 2026 |
request-file | ../../../../etc/passwd | 25 / 50 | 198.51.100.44 | Oct 13 2026 |
get-id | 1' UNION SELECT user_login,user_pass FROM wp_users-- | 34 / 68 | 198.51.100.9 | Oct 13 2026 |
request-id | 1' UNION SELECT user_login,user_pass FROM wp_users-- | 34 / 68 | 198.51.100.9 | Oct 13 2026 |
get-s | alert(document.cookie) | 25 / 50 | 203.0.113.140 | Oct 13 2026 |
request-s | alert(document.cookie) | 25 / 50 | 203.0.113.140 | Oct 13 2026 |
get-s | alert(document.cookie) | 25 / 50 | 203.0.113.77 | Oct 13 2026 |
request-s | alert(document.cookie) | 25 / 50 | 203.0.113.77 | Oct 13 2026 |
get-s | alert(document.cookie) | 25 / 50 | 203.0.113.25 | Oct 13 2026 |
request-s | alert(document.cookie) | 25 / 50 | 203.0.113.25 | Oct 13 2026 |
5
IP Blocked Attack Chart
IP Attack Blocked
| IP | Date |
|---|---|
203.0.113.10 | Oct 09 2026 |
198.51.100.44 | Oct 10 2026 |
203.0.113.140 | Oct 11 2026 |
198.51.100.9 | Oct 12 2026 |
203.0.113.25 | Oct 13 2026 |
HMWP IDS Log
| Name | Value | Page | Impact / Total | IP / User | Date | |
|---|---|---|---|---|---|---|
| GET.file | | | ../../../../etc/passwd | /?file=../../../../etc/passwd | 25 / 50 | 198.51.100.44 Guest KR | October 13, 2026 2:16 pm | |
| REQUEST.file | | | ../../../../etc/passwd | /?file=../../../../etc/passwd | 25 / 50 | 198.51.100.44 Guest KR | October 13, 2026 2:16 pm | |
| GET.id | | | 1' UNION SELECT user_logi... 1' UNION SELECT user_login,user_pass FROM wp_users-- | /?id=1%27%20UNION%20SELECT%20user_login,user_pass%20FROM%20wp_users-- | 34 / 68 | 198.51.100.9 Guest | October 13, 2026 2:16 pm | |
| REQUEST.id | | | 1' UNION SELECT user_logi... 1' UNION SELECT user_login,user_pass FROM wp_users-- | /?id=1%27%20UNION%20SELECT%20user_login,user_pass%20FROM%20wp_users-- | 34 / 68 | 198.51.100.9 Guest KR | October 13, 2026 2:16 pm | |
| GET.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.140 Guest KR | October 13, 2026 2:16 pm | |
| REQUEST.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.140 Guest KR | October 13, 2026 2:16 pm | |
| GET.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.77 Guest | October 13, 2026 2:16 pm | |
| REQUEST.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.77 Guest KR | October 13, 2026 2:16 pm | |
| GET.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.25 Guest KR | October 13, 2026 2:16 pm | |
| REQUEST.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.25 Guest KR | October 13, 2026 2:16 pm | |
| GET.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.25 Guest | October 13, 2026 2:16 pm | |
| REQUEST.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.25 Guest | October 13, 2026 2:16 pm | |
| Name | Value | Page | Impact / Total | IP / User | Date |
* Value is sanitized for your safety
How good is that, no intrusions.
No intrusions found.
HMWP Blocked IP Addresses
(5) | (4) | (1)
5 items
| 203.0.113.10 | | October 9, 2026 6:30 pm | ||
| 198.51.100.44 | | Outside Allowed Countries | October 10, 2026 3:17 am | |
| 203.0.113.140 | | Blocked Countries | October 11, 2026 10:05 pm | |
| 198.51.100.9 | | Trust Network | October 12, 2026 9:41 am | |
| 203.0.113.25 | | Manual Blocking | October 13, 2026 2:20 pm | |
| No items found. | |||
Manual Configuration
In rare cases you need to configure it manually.
- If you use BulletProof Security plugin, first secure the htaccess file using it and then add the following lines to your htaccess file using FTP.
- You may need to reconfigure the server whenever you change settings or activate a new theme or plugin.
- Add these lines right before: RewriteCond %{REQUEST_FILENAME} !-f. Next, you may want to change htaccess permission to read-only (e.g., 666)
Nothing to add for current settings!
Hide My WP
Settings was updated successfully!
Start
Purchase Code
Enter your Purchase Code to make sure everything work as expected. Get it.
Import Options
Paste your settings code below or choose a pre-made settings scheme.
Export Options
Copy your export code and save it somewhere for later use.
Copy your export code and save it somewhere for later use.
{"li":"","import_options":"","export_options":"","debug_report":"","help":"","undo":"","uninstall_hmwp_data":"","hide_wp_login":"","login_query":"hide_my_wp","admin_key":"1234","hide_wp_admin":"","spy_notifier":"","antispam":"","full_hide":"","hide_online_detectors":"","hide_other_wp_files":"","disable_directory_listing":"","disable_canonical_redirect":"","hide_admin_bar":"on","separator":"","custom_404":"0","custom_404_page":"","trusted_user_roles":"","replace_mode":"quick","customized_htaccess":"","cdn_path":"","email_from_name":"","email_from_address":"","avoid_direct_access":"","direct_access_except":"index.php, wp-comments-post.php, wp-includes/js/tinymce/wp-tinymce.php, xmlrpc.php, wp-cron.php, wp-admin/upgrade.php","exclude_theme_access":"","exclude_plugins_access":"","new_theme_path":"","new_style_name":"","style_expiry_days":"","auto_config_plugins":"","new_include_path":"","new_plugin_path":"","rename_plugins":"","new_upload_path":"","replace_comments_post":"","replace_admin_ajax":"","new_content_path":"","separator2":"","new_login_path":"","new_admin_path":"","separator3":"","api_disable":"0","api_base":"","api_query":"rest_route","author_enable":"1","author_base":"/author","author_query":"author","author_without_base":"","feed_enable":"1","feed_base":"/feed","feed_query":"feed","post_enable":"1","post_base":"/%postname%/","post_query":"p","page_enable":"1","page_base":"/","page_query":"page_id","paginate_enable":"1","paginate_base":"/page","paginate_query":"paged","category_enable":"1","category_base":"","category_query":"cat","tag_enable":"1","tag_base":"","tag_query":"tag","search_enable":"1","search_base":"/search","search_query":"s","nice_search_redirect":"","disable_archive":"","disable_other_wp":"","remove_html_comments":"","minify_new_style":"","replace_javascript_path":"1","remove_feed_meta":"on","remove_other_meta":"on","remove_default_description":"on","remove_ver_scripts":"","remove_body_class":"","remove_menu_class":"","clean_post_class":"","clean_new_style":"","replace_in_ajax":"","replace_wpnonce":"","disable_xml_rpc":"","internal_css":"","internal_js":"","enable_ids":"on","ids_mode":"0","ids_email":"admin@example.com","ids_level":"0","ids_admin_include":"","ids_cookie":"","logger_link":"","log_ids_min":"5","block_ids_min":"30","email_ids_min":"30","exception_fields":"REQUEST.comment[new_line]POST.comment[new_line]REQUEST.permalink_structure[new_line]POST.permalink_structure[new_line]REQUEST.selection[new_line]POST.selection[new_line]REQUEST.content[new_line]POST.content[new_line]REQUEST.__utmz[new_line]COOKIE.__utmz[new_line]REQUEST.s_pers[new_line]COOKIE.s_pers[new_line]REQUEST.user_pass[new_line]POST.user_pass[new_line]REQUEST.pass1[new_line]POST.pass1[new_line]REQUEST.pass2[new_line]POST.pass2[new_line]REQUEST.password[new_line]POST.password[new_line]POST.hide_my_wp.%[new_line]REQUEST.hide_my_wp.%[new_line]POST.%import%[new_line]REQUEST.%import%[new_line]REQUEST.newcontent[new_line]POST.newcontent[new_line]REQUEST.remember_%","ids_html_fields":"","separator4":"","avoid_wp_admin_access":"","allowed_ips_wp_admin_access":"203.0.113.10","trust_network":"on","help_trust_network":"","enable_smwp_server":"","blocked_ips":"","blocked_ip_message":"You are blocked. Please contact site administrator if you think there is a problem. ","blocked_countries":"","allowed_countries":"","replace1":"","replace2":"","new_intrusions_count":"0"}Debug Report
Provide above report to support team to get better and faster service.
===========================================================
WP Settings
===========================================================
WordPress version: WP 7.1.3
Home URL: https://example.com
Site URL: https://example.com
Is SSL: true
Is RTL: false
Permalink: /%postname%/
============================================================
Server Environment
============================================================
PHP Version: 8.3
Server Software: Apache
WP Max Upload Size: 2 GB
Server upload_max_filesize: 2048M
Server post_max_size: 2048M
WP Memory Limit: 40M
WP Debug Mode: false
CURL: true
fsockopen: true
============================================================
Active plugins
============================================================
Hide My WP 6.2.12 [http://hide-my-wp.wpwave.com/]
============================================================
Plugin Option
============================================================
{"li":"","import_options":"","export_options":"","debug_report":"","help":"","undo":"","uninstall_hmwp_data":"","hide_wp_login":"","login_query":"hide_my_wp","admin_key":"1234","hide_wp_admin":"","spy_notifier":"","antispam":"","full_hide":"","hide_online_detectors":"","hide_other_wp_files":"","disable_directory_listing":"","disable_canonical_redirect":"","hide_admin_bar":"on","separator":"","custom_404":"0","custom_404_page":"","trusted_user_roles":"","replace_mode":"quick","customized_htaccess":"","cdn_path":"","email_from_name":"","email_from_address":"","avoid_direct_access":"","direct_access_except":"index.php, wp-comments-post.php, wp-includes\/js\/tinymce\/wp-tinymce.php, xmlrpc.php, wp-cron.php, wp-admin\/upgrade.php","exclude_theme_access":"","exclude_plugins_access":"","new_theme_path":"","new_style_name":"","style_expiry_days":"","auto_config_plugins":"","new_include_path":"","new_plugin_path":"","rename_plugins":"","new_upload_path":"","replace_comments_post":"","replace_admin_ajax":"","new_content_path":"","separator2":"","new_login_path":"","new_admin_path":"","separator3":"","api_disable":"0","api_base":"","api_query":"rest_route","author_enable":"1","author_base":"\/author","author_query":"author","author_without_base":"","feed_enable":"1","feed_base":"\/feed","feed_query":"feed","post_enable":"1","post_base":"\/%postname%\/","post_query":"p","page_enable":"1","page_base":"\/","page_query":"page_id","paginate_enable":"1","paginate_base":"\/page","paginate_query":"paged","category_enable":"1","category_base":"","category_query":"cat","tag_enable":"1","tag_base":"","tag_query":"tag","search_enable":"1","search_base":"\/search","search_query":"s","nice_search_redirect":"","disable_archive":"","disable_other_wp":"","remove_html_comments":"","minify_new_style":"","replace_javascript_path":"1","remove_feed_meta":"on","remove_other_meta":"on","remove_default_description":"on","remove_ver_scripts":"","remove_body_class":"","remove_menu_class":"","clean_post_class":"","clean_new_style":"","replace_in_ajax":"","replace_wpnonce":"","disable_xml_rpc":"","internal_css":"","internal_js":"","enable_ids":"on","ids_mode":"0","ids_email":"admin@example.com","ids_level":"0","ids_admin_include":"","ids_cookie":"","logger_link":"","log_ids_min":"5","block_ids_min":"30","email_ids_min":"30","exception_fields":"REQUEST.comment\r\nPOST.comment\r\nREQUEST.permalink_structure\r\nPOST.permalink_structure\r\nREQUEST.selection\r\nPOST.selection\r\nREQUEST.content\r\nPOST.content\r\nREQUEST.__utmz\r\nCOOKIE.__utmz\r\nREQUEST.s_pers\r\nCOOKIE.s_pers\r\nREQUEST.user_pass\r\nPOST.user_pass\r\nREQUEST.pass1\r\nPOST.pass1\r\nREQUEST.pass2\r\nPOST.pass2\r\nREQUEST.password\r\nPOST.password\r\nPOST.hide_my_wp.%\r\nREQUEST.hide_my_wp.%\r\nPOST.%import%\r\nREQUEST.%import%\r\nREQUEST.newcontent\r\nPOST.newcontent\r\nREQUEST.remember_%","ids_html_fields":"","separator4":"","avoid_wp_admin_access":"","allowed_ips_wp_admin_access":"203.0.113.10","trust_network":"on","help_trust_network":"","enable_smwp_server":"","blocked_ips":"","blocked_ip_message":"You are blocked. Please contact site administrator if you think there is a problem. ","blocked_countries":"","allowed_countries":"","replace1":"","replace2":"","new_intrusions_count":0}Provide above report to support team to get better and faster service.
Quick Fix Guide
▸ Video Tutorials
- Make sure you have a writable htaccess file (if you use Apache) or configured your web server manually (if you use Nginx, IIS or enabled multi-site). Follow installation guide for details.
- Disable features which have an asterisk(*) in their names or use a more compatible settings scheme.
- See Frequently Asked Questions for common issues.
- To remove remained WP footprints use Replace Tools
- Use our dedicted Support Forum for other issues
Undo Settings
Click above to restore previous saved settings!
Clean Uninstall
Hiding
Hide Login Page
Login Query
Login parameter for protected login address (default: hide_my_wp) e.g. wp-login.php?hide_my_wp=ADMIN_KEY
Admin Login Key
Current Login url: /wp-login.php?hide_my_wp=1234 (Save changes to update) Want something like "/login"? Change New Login Path (Permalinks tab)
Hide Admin
Spy Notify
Anti-Spam
Full Hide
Hide Online Detectors
Hide Other Files
Directory List
Canonical Redirect
Hide Admin Bar
404 Page Template
Custom 404 Page
We use this as 404 page.
Trusted User Roles
Choose trusted user roles. (Administrator are trusted by default)
Replace Mode
How should we replace old URLs? (Use Full mode with cache)
Customized htaccess
CDN Path
Enter your main CDN address
Email sender nameWill be deprecated in next release.
e.g. John Smith
Email sender addressWill be deprecated in next release.
e.g. info@example.com
Hide PHP Files
Exclude Files
Except these PHP files (or folders). Separate with ,
Exclude Theme
Exclude Plugins
Permalinks
New theme path
e.g. "/template"
New style name
e.g. "main.css" (Require New theme name)
Style Expiry Header
(in days) for browser caching
Auto Configuration
New wp-includes path
e.g. "/lib"
New plugin path
e.g. "/modules"
Rename Plugins
New upload path
e.g. "/file". If your theme or your image plugins uses TimThumb (check source code) read here.
Post Comment
Change "wp_comments_post.php" URL (e.g. "/user_submit" or "/folder/user_submit.php").
AJAX URL
Change wp-admin/admin_ajax.php URL (e.g. "/ajax" or "ajax.php").
New wp-content path
e.g. "/inc" You usually do not need to use it. Only useful for some kinds of plugins (cache, gallery)
Change Login URL
Change wp-login.php e.g. login
New wp-admin Path*
Change "https://uknew.co/wp-admin" (e.g. panel, cp). REQUIRE to update wp-config.php manually
API
API Base
Change "/wp-json/" (e.g. rest, api). NOTE: Please flush the rewrite rule.
API Query
Change /?rest_route=1 (e.g. rest_api).
Author
Author Base
Change "/author/username" (e.g. user, profile, members/editrs/).
Author Query
Change /?author=1 and /?author_name=username (e.g. u, user, member).
Author without base
Feeds
Feed Base
Change /feed (e.g. xml, rss, index.xml).
Feed Query
Change /?feed=rss2 (e.g. xml, rss, sitefeed).
Post
Post Permalink
Post Query
Change /?p=1 (e.g. article_id, news_id or pid).
Page
Page Base
Change /sample-page to /X/sample-page (e.g. pages, static).
Page Query
Change /?page_id=1 or /?page_name=about (e.g. pages).
Paginate
Paginate Base
Change /page/2 (e.g. pages, go).
Paginate Query
Change /?paged=2.
Category
Category Base
Category Query
Change /?cat=1 or /?category_name=uncategorized (e.g. topic).
Tag
Tag Base
Tag Query
Change /?tag=tag1 (e.g. keyword, find).
Search
Search Base
Change /search/keyword (e.g. find, s, dl).
Search Query
Change /?s=keyword (e.g. find, s, dl).
Search base redirect
Disable Archive
Disable Other WP
Protection
Enable IDS
IDS Mode
Alert Email
Send IDS email alerts to this email
Enable IDS For
Monitor potential dangerous requests.
Track Admin
Monitor Cookies
Logs
Log Threshold
Minimium total impact to log the request. 0 to disable logging.
Block Threshold
Minimium total impact to block request with a 404 page. 0 to disable blocking *
Notify Threshold
Minimium total impact to notify you about the request by an email. 0 to disable notifing.
Exception fields
Define fields that will be excluded from PHPIDS. One field per line. e.g. POST.my_field
wildcard example: %.hide_my_wp.% You may need to add each field several times (GET.my_field and REQUEST.my_field)
HTML fields
Define fields that contain HTML and need preparation before hitting the PHPIDS rules. One field per line. Note: Fields must contain valid HTML
Show wp-admin only allowed IP's
Allowed IP's for wp-admin
Separate with , e.g. 203.0.113.3, 203.0.113.*, 198.51.100.1/24
Enable trust network
Participate in Trust Network
Scan My WP Whitelist
Blocked IPs
Separate with , e.g. 203.0.113.3, 203.0.113.*, 198.51.100.1/24 Do not enter your own IP for testing purposes!
Blocked Message
This message will be shown to blocked IPs. HTML is allowed.
Blocked Countries Code
Visitors from these countries will be blocked. Use ISO-2 code list. Separate with , e.g. US, UK, CA. Best result for less than ~100K visits/day
Allowed Countries Code
Only visitors from these countries will be allowed. Use ISO-2 code list. Separate with , e.g. US, UK, CAThis option will override `Blocked Countries Code` Leave blank for allow all countries.
Cleanup
Minify HTML
Remove comments and whitespaces from HTML (Use with cache).
Minify style
Remove theme info and other comments from stylesheet. (Require new style name)(Use with cache!).
Replace \/ URLs
Choose if you see Javascript URLs (e.g. \/wp-content\/themes)
Feed Meta
Other Meta
Default Tagline
Remove Version
Body Classes
Menu Classes
Post Classes
Clean up other
Replace in AJAX
Change Nonce
Disable XML RPC
Internal CSS
Useful to paste internal CSS code (Require New Theme Path)
Internal JS
Useful to paste internal JS code (Require New Theme Path)
Replace
Replace in HTML
Do not use this to change URLs
Use [bslash] for '\'
Base on OSes multiple lines queries may work or not so please check.'
Use [bslash] for '\'
Base on OSes multiple lines queries may work or not so please check.'
Replace URLs
Use this only to change URLs.
Relative path base on WP directory. e.g. wp-content/plugins/woocommerce/assets/css/woocommerce.css Replace ec.css
You can also replace some kind of custom paths
Add '/' at the end of the first path to change all files at the folder.
Relative path base on WP directory. e.g. wp-content/plugins/woocommerce/assets/css/woocommerce.css Replace ec.css
You can also replace some kind of custom paths
Add '/' at the end of the first path to change all files at the folder.
未登入訪客的畫面 — 以儲存的設定送出請求
302 → 200重新導向至 /wp-login.php
W
使用者名稱或電子郵件地址
密碼
保持登入登入
前往登入畫面，與預設的 WordPress 相同。
302 → 200
W
使用者名稱或電子郵件地址
密碼
保持登入登入
因為 Hide Admin 關閉，/wp-admin/ 會帶往隱藏的登入網址，變更網址的效果就沒了。
404
找不到符合條件的頁面
佈景主題的 404 頁面
對未登入的訪客來說，/wp-admin/ 看起來就是不存在的頁面。
200
W
使用者名稱或電子郵件地址
密碼
保持登入登入
在預設登入網址開啟登入畫面。
404
找不到符合條件的頁面
佈景主題的 404 頁面
因為 Hide Login Page 開啟，預設登入網址會回傳 404。
200
W
使用者名稱或電子郵件地址
密碼
保持登入登入
在變更後的登入網址開啟登入畫面。
404
找不到符合條件的頁面
佈景主題的 404 頁面
因為 Change Login URL 是空的，這個網址是不存在的頁面。
200
W
使用者名稱或電子郵件地址
密碼
保持登入登入
以 Login Query 與 Admin Login Key 開啟的備用網址，在任何設定下都能開啟登入畫面。金鑰值請改掉預設的 1234。
200
faultCode 403
faultString 不正確的使用者名稱或密碼。
faultString 不正確的使用者名稱或密碼。
XML-RPC 開啟時，不必經過登入畫面就會回答使用者名稱和密碼是否正確，就算變更登入網址也一樣。
405
faultCode 405
faultString 這個網站已停用 XML-RPC 服務。
faultString 這個網站已停用 XML-RPC 服務。
開啟 Disable XML RPC 後，需要登入的請求會被拒絕。
即使 [Start] 分頁的 Purchase Code 欄位留空，本文談到的變更登入網址、隱藏、關閉 XML-RPC 設定都能儲存並正常運作。Hide My WP 是在 CodeCanyon 販售的付費外掛。
2️⃣ 變更登入網址
開啟 [Hiding] 分頁的 Hide Login Page 後，預設的 [wp-login.php] 會回傳 404，勾選的同時也會展開 Login Query 與 Admin Login Key 欄位。
在 [Permalinks] 分頁的 Change Login URL 填入 newlogin 這類新網址並儲存，就會在該網址開啟登入畫面。新網址留空時，只能透過加上 Login Query 與 Admin Login Key 的備用網址登入，例如 [wp-login.php?hide_my_wp=1234]；這個備用網址在任何設定下都能開啟，所以金鑰值請改掉預設的 1234。
3️⃣ Hide Login Page & Hide Admin 設定
Hide Login Page 用來隱藏登入畫面，Hide Admin 則隱藏管理後台網址 /wp-admin/。
只隱藏登入畫面的話，未登入的訪客開啟 /wp-admin/ 時，WordPress 會把訪客帶到變更後的登入網址，新網址就這樣曝光了。就像換了大門密碼，警衛室卻把新密碼告訴每個來問的人。
🧭 隱藏的登入網址曝光的路徑
說明圖解🔐 Hide Login Page
↓
以登出狀態開啟
/wp-login.php預設登入網址
登入畫面不存在的頁面/newlogin變更後的登入網址
登入畫面🛡️ Hide Admin
↓
以登出狀態開啟
/wp-admin/管理後台網址
前往登入畫面前往新的登入網址不存在的頁面兩個設定都關閉時，與預設的 WordPress 相同：開啟 /wp-admin/ 會前往登入畫面（302），/wp-login.php 也會開啟登入畫面。
只開啟 Hide Admin 時，/wp-admin/ 會變成不存在的頁面（404），但預設登入網址 /wp-login.php 仍然可以開啟。
只隱藏登入畫面時，/wp-login.php 會變成不存在的頁面（404），但開啟 /wp-admin/ 的訪客會被帶到變更後的登入網址（302），因而得知新網址。
兩個都開啟時，/wp-admin/ 與 /wp-login.php 都會變成不存在的頁面（404），只有知道變更後網址的管理員才能開啟登入畫面。
連 Hide Admin 也開啟後，/wp-admin/ 對未登入的訪客會顯示為不存在的頁面（404），就無從得知新的登入網址。
4️⃣ 關閉 XML-RPC
即使隱藏了登入網址，[xmlrpc.php] 仍是另一個接受使用者名稱與密碼的入口。
開啟 [Cleanup] 分頁的 Disable XML RPC 後，需要登入的請求會以 405 和 [這個網站已停用 XML-RPC 服務。] 拒絕，但 [xmlrpc.php] 檔案本身仍會回應。要讓請求連 PHP 都到不了，就在伺服器設定中封鎖。
有時取消勾選 Disable XML RPC 並儲存後，設定仍維持開啟，所以儲存後要再用實際回應確認一次。
5️⃣ 停用 Hide My WP 後留下的 .htaccess 規則
按下 [Save Settings] 時，Hide My WP 會在 .htaccess 的 WordPress 區塊內加入新登入網址的規則。
# .htaccess — 將 Change Login URL 儲存為 newlogin 後加入的那一行
RewriteRule ^newlogin /wp-login.php?zV_hide_my_wp=1234 [QSA,L]即使停用外掛，這一行仍留在 .htaccess，變更後的網址也繼續開啟登入畫面。清理外掛時，要從 .htaccess 刪除這一行再儲存。
ℹ️ 聯盟行銷說明
本站內容包含聯盟行銷連結。訪客透過這些連結購買商品或服務時，本站會從賣家獲得佣金。在這個過程中，購買者支付的金額（遇到活動折扣時金額會降低↓）並不會因此提高。刊登的價格、折扣與庫存資訊以撰寫當時為準，可能與實際情況不同，購買前請向賣家做最後確認。商品的挑選與評價依本站自訂的標準撰寫，是否支付佣金不會影響介紹順序或評價內容。