# How To Hide the Dashboard from Visitors With BetterShield?
Answer signed-out requests for /wp-admin/ with a 404 instead of the sign-in form, so the dashboard does not hand out a moved sign-in address.
With **[BetterShield](/)**, answer signed-out requests for /wp-admin/ with a 404 instead of the sign-in form, so the dashboard does not hand out a moved sign-in address.
## What it does
In **[BetterShield](/)**, WordPress sends a signed-out visitor who asks for /wp-admin/ to the sign-in page, which tells them the site runs WordPress and where to sign in. **Dashboard privacy for visitors** answers them with a 404 instead. Signed-in users notice nothing. It is under **Signing in** on **BetterShield › Protection › Login & Access**, and it starts off. It matters most beside [Change the sign-in address](/docs/change-sign-in-address/), because without it /wp-admin/ redirects anyone who asks to the new address.
- **Answers 404 when a signed-out visitor asks for a dashboard page**, anywhere under /wp-admin/. The page is titled "Not found" and says "This page is not available."
- **Leaves admin-ajax.php and admin-post.php working**, which front-end features rely on while signed out. The REST API is not under /wp-admin/ and is not affected.
- **Does not rename the dashboard**, which plugins rely on finding where it is. Signed-in users reach it exactly as before.
It changes only what /wp-admin/ answers. Without a moved address, people still sign in at wp-login.php. It runs inside WordPress, so it works on any web server. Safe mode pauses it, and it stops while BetterShield is deactivated.
## Step 1: Open BetterShield › Protection › Login & Access
Open **BetterShield › Protection › Login & Access** and find **Dashboard privacy for visitors** under **Signing in**.
Review the state and choices shown on your own site before applying a change.
## Step 2: Hide the Dashboard From Visitors
- Press **Preview the change** to read what it does. Nothing changes.
- Turn the switch on. The row reads **On since** and **Undo never expires**.
It has no options. Once it is on, the warning about /wp-admin/ on **Custom sign-in address** goes away.
### Before it applies
Like every **Signing in** fix, applying it first checks your way back in: a working recovery link or unused recovery code, checked within the last day. If that fails, **Check the way back in first** offers **Check now** (or **Open Recovery**) and **Go ahead anyway**, which is logged. See [Set up recovery](/docs/set-up-recovery/). Applying needs a signed-in browser, not an application password.
### Monitor first
**Monitor first**, at the end of the row, counts real requests without refusing any: every request for a dashboard address is observed, and it is matched when it came from someone signed out who would have got the 404.
- Choose a **New observation window** (**1 hour**, **24 hours**, which is preselected, or **7 days**) and press **Start monitoring with the fields above**.
- The panel reads, for example, "520 requests observed; 37 matched this rule." **End monitoring now** stops early.
- When the window ends, press **Enforce reviewed settings**. It needs a usable recovery link or recovery codes and safe mode off, and leaves the usual undo. Like the switch, it first checks your way back in: if that check fails, **Check the way back in first** opens, and **Go ahead anyway** is logged.
The observed count includes signed-in work in the dashboard and calls to admin-ajax.php, which this fix never refuses. Scripts and people both appear among the matches. Checkout traffic is not counted. Counts are kept for at least a week after the window ends.
### From WP-CLI
```
wp bettershield harden admin_gate --dry-run
wp bettershield harden admin_gate --user=admin
```
A connected AI assistant can only propose this fix, as a plan you agree to. See [WP-CLI commands](/docs/wp-cli-commands/).
## Recommended settings
We recommend turning it on whenever you move the sign-in address: the two are meant to go together. On its own it is a small, quiet change, worth making once everyone who signs in uses the sign-in address rather than /wp-admin/.
| Site | What we recommend |
|---|---|
| Membership or course site | Check your menus and emails first: a "Log in" link pointing at /wp-admin/ now leads to a 404. Point it at the sign-in address instead. |
| Agency or many sites | Give clients the sign-in address to bookmark, not /wp-admin/. |
## What it can break, and how to undo
- **Signing in through /wp-admin/.** Anyone who reaches the sign-in form by typing /wp-admin/, or through a bookmark or link to it, now gets a 404. They use the sign-in address instead: wp-login.php, or your moved address.
- **A session that has ended.** When someone's session ends (an idle sign-out, a sign-out from another device, or rotated sign-in keys), the next dashboard page they open answers 404 instead of sending them to sign in.
- **Another plugin that moves sign-in.** When another active plugin moves or hides the sign-in page (such as WPS Hide Login, Rename wp-login.php or Defender, or Solid Security, All-In-One Security or a licensed Patchstack with that feature on), the row names it and says it also decides what a signed-out visitor sees at /wp-admin/: whichever runs first answers, so check its sign-in address still works afterwards.
To undo, turn the switch off. /wp-admin/ redirects signed-out visitors to the sign-in page again at once. Undo needs a signed-in browser, and your password if **Ask for my password before removing a protection** is on. From the terminal: `wp bettershield harden admin_gate --undo --user=admin`. If you cannot sign in at all, your recovery link turns on safe mode, which pauses this fix. See [Locked out](/docs/locked-out/).
## Final Outcome
**The address.** In a private window, open yoursite.com/wp-admin/: "Not found", with a 404. Signed in, the dashboard opens as usual.
- **The row.** **On since**, and "This one has no effect a page view can check, so it is reported from your settings."
- **The activity log.** "Hardening applied" and "Hardening undone" name the fix. Each **Monitor first** start, stop or enforce is "Setting changed", and going past the recovery check is "Sign-in change made without a recovery check".
- **Findings.** No finding opens while it is off. While it is on, **Some protections that are switched on are not working** (Medium) names it if it reads as on but is no longer in force, for example because another plugin took it off.
Example Hide the dashboard view. Check the saved values and status on your own site.
## On multisite
Each site has its own switch, and it answers for that site's dashboard addresses only.
## Related
- [Change the sign-in address](/docs/change-sign-in-address/)
- [Login & Access](/docs/login-and-access/)
- [Low-privilege accounts](/docs/low-privilege-dashboard/)
- [Locked out](/docs/locked-out/)
- [Sessions](/docs/sessions/)
- [Change WordPress login URL](/blog/change-wordpress-login-url/)
This is how you can hide the dashboard from visitors with BetterShield.
Getting Stuck? Feel free to contact our [Dedicated Support Team](/support/).
