Moving the login URL: set up, verify, revert
What has to be in place beforehand
Out of the box the feature is off, and it never switches itself on. Three things prevent the move altogether — the switch then stays locked and names the reason: (1) The emergency brake define( 'KWPSEC_LOGIN_SLUG_OFF', true ); is set in wp-config.php. (2) The installation is a multisite network; there all sites share one sign-in, so the move would have to happen network-wide. (3) The permalinks are set to “Plain”. A path like /gartentor then never reaches PHP at all, the web server answers with a 404 before that. Switch to a different structure under Settings › Permalinks before you carry on.
Choosing a path
3 to 40 characters are allowed: lower-case letters, digits, hyphen and underscore. No slashes, no umlauts, no period; capital letters are converted to lower case. Four checks run when you save: names from the usual bot lists (login, wp-login, admin, wp-admin, anmelden, dashboard and the like) are rejected, because they would be found again within minutes. If a file or a directory of that name already exists in the WordPress installation, it is rejected — the web server would deliver that one before PHP is even asked. Reserved routes such as wp-json, feed, author, category, sitemap or favicon are blocked. And if a post or a page already sits at that path, it is rejected, because it would no longer be reachable afterwards. A saved path is not yet in force — it only takes effect once you additionally switch the move on.
Switching on: what happens automatically
When the switch is flipped, the setting is saved and the server then makes two real HTTP requests against its own installation: one to the new address, one to the old one. Each request has an 8-second time limit, follows no redirects and sends no cookies. As proof that the sign-in page really answered, the returned text is searched for id="loginform" and name="log". If the new address answers with HTTP 404 and without a login form, the change is withdrawn immediately and the old state is restored — in that case the try_files line is usually missing on nginx, and the .htaccess on Apache. If the check passes, the plugin sends the new address as a plain-text email to the notification address on file (failing that, to the admin email); the email also contains the emergency-brake line for wp-config.php. The feedback says plainly whether wp_mail() accepted the message — if it did not, make a note of the address now. An entry is written to the activity log as well.
What changes in everyday operation
Under the new path the original wp-login.php file is included, not rebuilt — security updates from WordPress take effect there immediately. For signed-out visitors, /wp-login.php behaves like any address that does not exist: the request is rewritten to an unused path and rendered by the theme as a perfectly normal 404, with no error message of its own — a message of its own would be the very hint that something is hidden here. Anyone who is signed in still gets through; that is intentional. If a signed-out visitor calls /wp-admin/, a 302 leads to the home page instead of to the sign-in, otherwise the new address would appear in the Location header. admin-ajax.php, admin-post.php, load-styles.php and load-scripts.php remain reachable so that contact forms, shopping carts and reviews keep working. All addresses that WordPress generates via site_url(), network_site_url() or wp_redirect() — wp_login_url(), wp_logout_url(), wp_lostpassword_url(), the action attribute of the form — automatically point to the new path.
If you lock yourself out or something gets stuck
First way: as long as a valid login cookie is in your browser, you reach /wp-login.php and /wp-admin/ unchanged. Second way: the address is in the email about the switch-over. Third way: enter define( 'KWPSEC_LOGIN_SLUG_OFF', true ); in wp-config.php — wp-login.php then applies again immediately, and the switch stays locked until you remove the line. The admin area also has two buttons: one that repeats the verification request and reports the HTTP code, the response time and the status of the old address, and one that sends the access email again. If the verification request reports a network error instead of an HTTP code, the loopback is usually blocked at the host — that does not mean the address is not working; call it up yourself once. If a link from another plugin still points to wp-login.php, it is hard-wired there and does not go through site_url(); only what passes through these filters can be rewritten. You can switch back at any time using the same switch.