How To Hide the Dashboard from Visitors With BetterShield?

With BetterShield, answer signed-out requests for /wp-admin/ with a 404 instead of the sign-in form, so the dashboard does not hand out a moved sign-in address.

What it does

In BetterShield, WordPress sends a signed-out visitor who asks for /wp-admin/ to the sign-in page, which tells them the site runs WordPress and where to sign in. Dashboard privacy for visitors answers them with a 404 instead. Signed-in users notice nothing. It is under Signing in on BetterShield › Protection › Login & Access, and it starts off. It matters most beside Change the sign-in address, because without it /wp-admin/ redirects anyone who asks to the new address.

• Answers 404 when a signed-out visitor asks for a dashboard page, anywhere under /wp-admin/. The page is titled “Not found” and says “This page is not available.”
• Leaves admin-ajax.php and admin-post.php working, which front-end features rely on while signed out. The REST API is not under /wp-admin/ and is not affected.
• Does not rename the dashboard, which plugins rely on finding where it is. Signed-in users reach it exactly as before.

It changes only what /wp-admin/ answers. Without a moved address, people still sign in at wp-login.php. It runs inside WordPress, so it works on any web server. Safe mode pauses it, and it stops while BetterShield is deactivated.

Step 1: Open BetterShield › Protection › Login & Access

Open BetterShield › Protection › Login & Access and find Dashboard privacy for visitors under Signing in.

Step 2: Hide the Dashboard From Visitors

• Press Preview the change to read what it does. Nothing changes.
• Turn the switch on. The row reads On since and Undo never expires.

It has no options. Once it is on, the warning about /wp-admin/ on Custom sign-in address goes away.

Before it applies

Like every Signing in fix, applying it first checks your way back in: a working recovery link or unused recovery code, checked within the last day. If that fails, Check the way back in first offers Check now (or Open Recovery) and Go ahead anyway, which is logged. See Set up recovery. Applying needs a signed-in browser, not an application password.

Monitor first

Monitor first, at the end of the row, counts real requests without refusing any: every request for a dashboard address is observed, and it is matched when it came from someone signed out who would have got the 404.

• Choose a New observation window (1 hour, 24 hours, which is preselected, or 7 days) and press Start monitoring with the fields above.
• The panel reads, for example, “520 requests observed; 37 matched this rule.” End monitoring now stops early.
• When the window ends, press Enforce reviewed settings. It needs a usable recovery link or recovery codes and safe mode off, and leaves the usual undo. Like the switch, it first checks your way back in: if that check fails, Check the way back in first opens, and Go ahead anyway is logged.

The observed count includes signed-in work in the dashboard and calls to admin-ajax.php, which this fix never refuses. Scripts and people both appear among the matches. Checkout traffic is not counted. Counts are kept for at least a week after the window ends.

From WP-CLI

wp bettershield harden admin_gate --dry-run
wp bettershield harden admin_gate --user=admin

A connected AI assistant can only propose this fix, as a plan you agree to. See WP-CLI commands.

Recommended settings

We recommend turning it on whenever you move the sign-in address: the two are meant to go together. On its own it is a small, quiet change, worth making once everyone who signs in uses the sign-in address rather than /wp-admin/.

What it can break, and how to undo

• Signing in through /wp-admin/. Anyone who reaches the sign-in form by typing /wp-admin/, or through a bookmark or link to it, now gets a 404. They use the sign-in address instead: wp-login.php, or your moved address.
• A session that has ended. When someone’s session ends (an idle sign-out, a sign-out from another device, or rotated sign-in keys), the next dashboard page they open answers 404 instead of sending them to sign in.
• Another plugin that moves sign-in. When another active plugin moves or hides the sign-in page (such as WPS Hide Login, Rename wp-login.php or Defender, or Solid Security, All-In-One Security or a licensed Patchstack with that feature on), the row names it and says it also decides what a signed-out visitor sees at /wp-admin/: whichever runs first answers, so check its sign-in address still works afterwards.

To undo, turn the switch off. /wp-admin/ redirects signed-out visitors to the sign-in page again at once. Undo needs a signed-in browser, and your password if Ask for my password before removing a protection is on. From the terminal: wp bettershield harden admin_gate --undo --user=admin. If you cannot sign in at all, your recovery link turns on safe mode, which pauses this fix. See Locked out.

Final Outcome

The address. In a private window, open yoursite.com/wp-admin/: “Not found”, with a 404. Signed in, the dashboard opens as usual.

• The row. On since, and “This one has no effect a page view can check, so it is reported from your settings.”
• The activity log. “Hardening applied” and “Hardening undone” name the fix. Each Monitor first start, stop or enforce is “Setting changed”, and going past the recovery check is “Sign-in change made without a recovery check”.
• Findings. No finding opens while it is off. While it is on, Some protections that are switched on are not working (Medium) names it if it reads as on but is no longer in force, for example because another plugin took it off.

On multisite

Each site has its own switch, and it answers for that site’s dashboard addresses only.

Related

• Change the sign-in address
• Login & Access
• Low-privilege accounts
• Locked out
• Sessions
• Change WordPress login URL

This is how you can hide the dashboard from visitors with BetterShield.

Getting Stuck? Feel free to contact our Dedicated Support Team.