Mask My Admin – WordPress Login Security & URL Protection

FAQ

How do I change the admin URL?

After activating the plugin, go to MaskMyAdmin in the admin menu and enter your desired login slug (e.g., my-login). Your admin URL will become yourdomain.com/my-login.

What happens to wp-login.php and wp-admin?

Both wp-login.php and /wp-admin access will redirect to the homepage or a custom URL (configurable), effectively hiding them from bots or attackers.

How do I enable IP whitelisting?

Under the plugin settings (Advanced Security tab), you can enable IP whitelisting and enter allowed IP addresses. Only visitors from these IPs will be able to access the login page.

I’m behind Cloudflare / a proxy. How do I get the correct IP?

Go to Advanced Security → Proxy / CDN Configuration and select the appropriate header for your setup (e.g., “Cloudflare” for CF-Connecting-IP).

What if I get locked out?

You have several recovery options:

1. WP-CLI: Run wp maskmy disable to disable all protections
2. wp-config.php: Add define('MASKMY_DISABLE', true); to bypass the plugin entirely
3. FTP: Rename the plugin folder via FTP or your hosting File Manager

Does this work with Nginx?

Yes. The plugin uses PHP for all URL masking and IP enforcement, which works on any server. The .htaccess rules are an additional layer for Apache servers only.

How long are activity logs kept?

Log entries older than 30 days are automatically cleaned up daily via WP-Cron.

What WP-CLI commands are available?

MaskMyAdmin registers the wp maskmy command namespace with the following subcommands:

• wp maskmy status — Show current configuration (login slug, redirect mode, IP whitelist status, allowed IPs, proxy header)
• wp maskmy reset — Reset the login URL back to the WordPress default (wp-login.php)
• wp maskmy add-ip <ip> — Add an IP address or CIDR range to the whitelist (e.g., wp maskmy add-ip 192.168.1.100 or wp maskmy add-ip 10.0.0.0/24)
• wp maskmy remove-ip <ip> — Remove an IP address or CIDR range from the whitelist (auto-disables whitelist if the list becomes empty)
• wp maskmy disable — Disable all protections immediately (resets login slug, redirect, and IP whitelist — useful for emergency recovery)
• wp maskmy enable --slug=<slug> — Re-enable protections with a custom login slug (e.g., wp maskmy enable --slug=my-login). If --slug is omitted, re-enables with the previously saved slug.