The default WordPress login page shows the WordPress logo and links to WordPress.org. For client sites, membership sites and shops, a branded login looks more professional. It’s also a good moment to tighten login security.

Change the logo and colours

Add this to a small plugin or your child theme’s functions.php:

add_action( 'login_enqueue_scripts', function () { ?>
  <style>
    body.login { background: #0f172a; }
    #login h1 a {
      background-image: url(<?php echo esc_url( get_stylesheet_directory_uri() . '/images/logo.svg' ); ?>);
      background-size: contain;
      width: 220px;
      height: 64px;
    }
    .login form { border-radius: 12px; border: 0; box-shadow: 0 10px 30px rgb(0 0 0 / .25); }
    .wp-core-ui .button-primary { background: #1d4ed8; border-color: #1d4ed8; }
    .login #nav a, .login #backtoblog a { color: #cbd5e1; }
  </style>
<?php } );

For larger changes, enqueue a stylesheet instead: wp_enqueue_style( 'my-login', get_stylesheet_directory_uri() . '/login.css' );.

Point the logo to your site

add_filter( 'login_headerurl', fn() => home_url( '/' ) );
add_filter( 'login_headertext', fn() => get_bloginfo( 'name' ) );

Add a message or change the error text

// Message above the form
add_filter( 'login_message', fn( $msg ) => $msg . '<p class="message">Staff login. Customers, please use the account page.</p>' );

// Generic error — don't reveal whether the username exists
add_filter( 'login_errors', fn() => 'Incorrect username or password.' );

Redirect after login

Send non-admin users to a front-end page instead of the dashboard:

add_filter( 'login_redirect', function ( $redirect_to, $requested, $user ) {
    if ( $user instanceof WP_User && ! user_can( $user, 'edit_posts' ) ) {
        return home_url( '/account/' );
    }
    return $redirect_to;
}, 10, 3 );

Plugins that do it without code

  • LoginPress — a visual login page customizer with templates.
  • Theme My Login — moves login, registration and password reset into your theme’s pages.
  • Many membership and WooCommerce setups already provide front-end login forms.

Secure the login

Customizing the look is cosmetic; bots don’t care about your logo. On every WordPress site:

  1. Use strong passwords and two-factor authentication for every account with editing rights (Wordfence Login Security, Two Factor or similar). See our Sucuri vs Wordfence comparison.

  2. Limit login attempts with a plugin or at the server level with Fail2ban.

  3. Disable XML-RPC if you don’t use it (the Jetpack app and some remote publishing tools need it) — it’s a common brute-force target:

    location = /xmlrpc.php { deny all; }

  4. Rate-limit wp-login.php in Nginx — on your own server this stops floods before PHP runs:

    # http {} block
limit_req_zone $binary_remote_addr zone=wplogin:10m rate=5r/m;

# server {} block
location = /wp-login.php {
    limit_req zone=wplogin burst=5 nodelay;
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/run/php/php8.3-fpm.sock;
}

  5. Optional: restrict /wp-admin by IP for single-admin sites, or put it behind HTTP basic auth.

Changing the login URL (with a plugin like WPS Hide Login) reduces bot noise in logs, but it isn’t a substitute for the steps above.

Summary

Brand the login page with a few lines of CSS and filters, send users where they belong after logging in, and protect the form with 2FA and rate limiting. Running WordPress on a VPS lets you add the Nginx and Fail2ban protections that shared hosting usually can’t.

  • WordPress
  • Security
  • Development