How to Recover Your WordPress Admin Login URL After Forgetting Your Kadence Security Custom Login Slug

Getting a 404 error when you try to access your WordPress admin login URL? There are plenty of possible causes, but one of them is that you previously set a custom login URL using the Kadence Security plugin (formerly iThemes Security) and have since forgotten what you changed it to.

Don’t worry — this tutorial will walk you through several methods to recover your custom login URL and regain access to your WordPress admin dashboard.

Start your WordPress site today with KamHost — 1-click install, free SSL, from $3.50/mo.

Before You Begin

Make sure you have access to at least one of the following:

• FTP/SFTP access to your website files
• Hosting control panel (e.g., Hepsia, cPanel, or aaPanel)
• Database management tool (e.g., phpMyAdmin)
• SSH/command-line access to your server

Method 1: Find the Custom Login Slug in the Database (Recommended)

Since iThemes Security version 6.3.0 and later, all plugin settings — including the “Hide Backend” configuration — are stored as a PHP serialized array in the WordPress database.

Step 1: Access Your Database

1. Log in to your hosting control panel
2. Open phpMyAdmin or your preferred database management tool
3. Select your WordPress database

Step 2: Locate the KadenceSecurity Settings

Run the following SQL query:

sql

SELECT * FROM `wp_options` WHERE `option_name` = 'itsec-storage';

Note: If your database table prefix is not wp_, replace it accordingly (e.g., wp2_options).

Step 3: Find the Login Slug

Look at the option_value field. It will contain data that looks like this (it may appear as serialized PHP or JSON-like format depending on your plugin version):

If it looks like JSON:

json

"hide-backend": {
  "enabled": true,
  "slug": "your-custom-login-slug",
  "register": "wp-signup.php"
}

If it looks like serialized PHP:

text

s:7:"enabled";b:1;s:4:"slug";s:14:"your-custom-login-slug";

The value next to "slug" (or `s:4:”slug”;s:14:”…”) is your custom login slug.

Your login URL will be:

text

https://yourdomain.com/your-custom-login-slug

Method 2: Check the .htaccess File (For Older Plugin Versions)

If you are using an older version of iThemes Security (pre-6.3.0), the custom login slug may be written directly to the .htaccess file.

Step 1: Access Your Files

1. Connect via FTP or use your hosting File Manager
2. Navigate to your WordPress root directory
3. Locate the .htaccess file

Step 2: Search for the Hide Backend Rules

Look for a block similar to this:

apache

# BEGIN Hide Backend
# Rules to hide the dashboard
RewriteRule ^(/)?your-custom-slug/?$ /wp-login.php [QSA,L]
# END Hide Backend

The part between ^/ and /?$ is your custom login slug.

Method 3: Use WP-CLI (Fastest for Command Line Users)

If you have WP-CLI installed and shell access, you can quickly retrieve the slug:

bash

wp option get itsec-storage

Or to filter for just the slug:

bash

wp option get itsec-storage --format=json | jq '."hide-backend".slug'

Method 4: Create a PHP File to Display the Login URL

If you have file access but no database tools, this is a quick workaround.

Step 1: Create a PHP File

Create a file named show-login-url.php in your WordPress root directory with this content:

php

<?php
include 'wp-load.php';
echo 'Your login URL is: ' . wp_login_url();
?>

Step 2: Access the File

Visit https://yourdomain.com/show-login-url.php in your browser. It will display your current login URL.

⚠️ Security Note: Delete this file immediately after use!

Emergency Recovery: If All Else Fails

If you cannot locate the custom slug using any of the methods above, you can regain access by temporarily disabling the plugin.

Step 1: Disable Kadence Security via FTP / File Manager

1. Connect via FTP or open your hosting File Manager
2. Navigate to wp-content/plugins/
3. Locate the better-wp-security folder
4. Rename it to better-wp-security-disabled

Step 2: Log In with the Default URL

Now you can access the default WordPress login URL:

text

https://yourdomain.com/wp-admin

or

text

https://yourdomain.com/wp-login.php

Log in to your admin dashboard.

Step 3: Reactivate and Update the Login Slug

1. Rename the plugin folder back to better-wp-security
2. Refresh your admin dashboard — your session should remain active
3. Go to Security → Settings → Advanced → Hide Backend → Configure Settings
4. Review or change your Login Slug to something you will remember

Step 4: Save and Test

1. Click Save Changes
2. Test the new login URL immediately
3. Bookmark it and save it in your password manager

Important: What If You Are Already Logged In?

If you are reading this tutorial while still logged into your admin dashboard (for example, you kept a browser tab open), you have an even easier path:

1. Go to Security → Settings → Advanced → Hide Backend
2. Look at the “Login Slug” field — the current value is displayed there
3. Copy it, save it somewhere safe, and use it to log in next time
4. If you want to disable the feature entirely, simply toggle it OFF and save

Troubleshooting Common Issues

The custom URL returns a 404 even after finding it

• Go to Settings → Permalinks and click Save Changes (this refreshes rewrite rules)
• Clear your browser cache and cookies
• Try a private/incognito window

The default wp-admin also shows 404

• The plugin may have additional security features enabled (e.g., “Disable File Editor,” “Force SSL”)
• Temporarily disable the plugin via FTP and reconfigure settings from your dashboard

Can’t find itsec-storage in the database

• Try searching for itsec in the option_name field:sqlSELECT * FROM `wp_options` WHERE `option_name` LIKE ‘%itsec%’;
• Older plugin versions may use itsec_hide_backend

Prevention Tips

To avoid this situation in the future:

✅ Do This	❌ Avoid This
Save your custom login URL in a password manager	Relying on memory alone
Bookmark the login page after setup	Closing the browser before testing
Test the new URL while still logged in	Setting the slug to something too generic
Keep a backup admin account or recovery method	Forgetting where you saved the URL

Summary

Method	Best For	Complexity
Database (phpMyAdmin)	Most reliable, works for all versions	Medium
.htaccess file	Older plugin versions	Easy
WP-CLI	Server admins with command line access	Easy
PHP file	Quick temporary access	Easy
Disable plugin via FTP	Emergency recovery when all else fails	Easy

If you are still having trouble after trying these methods, check your server’s error logs or contact your hosting provider for assistance. The problem may not be Kadence Security-related at all — it could be a server configuration, SSL certificate issue, or other plugin conflict.