Consider WordPress, which houses all of its admin functions in the
/wp-admin/ directory. Accordingly, its admin URLs all begin with
/wp-admin/. I'm wondering if it would be significantly more secure to have each installation use a unique name for the admin folder and URLs, For example, the admin folder for a particular installation might be
The first thing that comes to mind is that this is security through obscurity. However, this seems like it could be an effective, first-line-of-defense against automated scripts. If the name was sufficiently random and long enough, there is no way an attacker could guess the name of the admin folder. Also, in zero-day attack against a newly found security hole against the admin side, this might be the only defense.
Should off-the-shelf web applications like WordPress provide a way to change default admin URLs?
To be clear, I am not thinking that this should replace any other security measure; I'm only wondering if the additional security (if any) would be worth the effort.