Are indexed Wordpress admin pages a security threat?

When a new bug is found, in this case in wordpress, the first thing hackers will do is try to find vulnerable sites that use wordpress. A good way of doing it is trying to find wp-admin pages on google. Maybe will even use automated tools to find-and-exploit sites based on that.

Avoiding that would be the main security reason for doing it. If you have no public sign that you are using Wordpress (or at least not the most common ones like this), you are less likely to be a randomly chosen as target for an attack.


Security issue? Doubt it. It just makes your site more visible to people who likes to attack wordpress sites. Other than the visibility everything is the same, security through obscurity is not something you should rely on anyway.

Useless? Definitely. There is no reason to allow indexing of your admin login in your site. You don't want your users finding a link to your admin when they are actually searching for your content. The only person who should care about that is the site admin.


Google doesn't want to index non-content pages including admin pages and pages that ask you to login. Putting wp-admin in robots.txt is better for SEO because it will usually prevent the page from being indexed.

It is possible that an attacker will do a Google for all sites that have wp-admin in the URL. Keeping that page on your site out of the Google search results will make it less likely for an attacker to find your site.