I have some small Drupal 7 sites that don't require me to log in all the times, and there are no users. I would like to change the user login path to something else to deter bots targeting Drupal installations on the /user path.
How can I achieve this?

I can add a CAPTCHA, but I want to change the path too.

  • Why So Serious ? Use some htaccess with IP matching to keep everyone accessing the /user path away. Simplest method I can think of.
    – AKS
    Commented May 30, 2013 at 2:47
  • Perhaps easier to add reCaptcha or similar to the relevant forms, though IP address restrictions on the relevant paths would also work. Commented May 30, 2013 at 2:51
  • you can do it using create separate page by using penal then define login form on this my page when user try to login redirect it on that page hopefully its helps you Commented Sep 22, 2015 at 11:46
  • If you go to 'admin/config/search/path' you can set alias for 'user/login'.
    – arpitr
    Commented Sep 22, 2015 at 13:15

5 Answers 5


See the Rename Admin Paths module. The purpose of this module is to secure drupal backend by overriding admin path. You can change user/login to something like member/login. I would also suggest adding a redirect in your htaccess to the standard user/login user/register. This way Drupal doesn't also have to serve up the 404 when a bot tries to access those pages. Huge performance savings.

EDIT: Thinking about this further, you don't need an extra module at all. Just add an alias at /admin/config/search/path/add for user/login, user/register etc, then just add redirects in your htaccess for the old aliases.

  • Thats the thing I want them to generate a 404 error if they goto /user path. What worries me is if this would cause issues for other modules that reference /user. Commented Jan 29, 2013 at 23:20
  • 2
    Why generate a 404 which on an 'average' site with an 'average' module load, you can be looking at 60-100MB of memory being consumed on your server to deliver a 404. If you are the only one accessing user/login, then screw everyone else and let an htaccess redirect send them off to a black hole or infinite loop. Something like one of the methods suggested at stackoverflow.com/questions/10707924/… Commented Jan 29, 2013 at 23:46

1.You can render login form on any site or in any block like this:

$form = drupal_get_form("user_login"); 
$form = drupal_render($elements);
print $form;

You then just need to set proper alias for this page.


$current_path = current_path();
 $current_alias = drupal_get_path_alias($current_path);
 if($current_alias == 'user'){
  • read carefully, the question is not about to redirect to another url. Question is about to change url path from user to my-url .
    – WaQaR Ali
    Commented Sep 22, 2015 at 12:01
  • look at the db table url_alias. user is a source not an alias. So if I am understanding it correctly, you can not change this so easily Commented Sep 22, 2015 at 12:08
  • Thanks, I'm going to try. I had some problem in the past using drupal_goto(), any other way to get the same using other function?
    – chefnelone
    Commented Sep 22, 2015 at 13:12
  • I need to remove the "user" url access.
    – chefnelone
    Commented Sep 22, 2015 at 13:13
  • you mean if somebody calls your_domain.com/user, access denied should occur? Commented Sep 22, 2015 at 13:14

I have a quick and easy solution I use for this scenario with no modules required. Use htaccess to redirect any visitors to user or user/login to a 404 (or I redirect them to a hidden page that logs their IP address so I can track how often they visit). Then when you want to login just user a bogus parameter in the url like /user/login/12345 This will send 99% of these spam bots off into space :)


You have a couple approaches to change the "user" Drupal path to "my-url":

First, you imitate the way Drupal defines the "user" path on user core module. In that way your "my-url" page will have same behavior than the original one.

Then, to complete the work you will need to redirect all "user" requests to your "my-url" path. To do that you can use custom code by using the hook_menu_site_status_alter() hook or you could use the redirect module.

Here's a quick implementation with custom code:

 * Implements hook_menu().
function yourmodule_menu() {

  // Registration and login pages.
  $items['my-url'] = array(
    'title' => 'User account',
    'title callback' => 'user_menu_title',
    'page callback' => 'user_page',
    'access callback' => TRUE,
    'file' => 'user.pages.inc',
    'weight' => -10,
    'menu_name' => 'user-menu',
    'file path' => drupal_get_path('module', 'user'),

  return $items;

 * Implements hook_menu_site_status_alter().
function yourmodule_menu_site_status_alter(&$menu_site_status, $path) {
  if ($path == 'user') {

Note: the redirect module is not integrated with features module. If you want to propagate automatically this change to all your environments I suggest you to use custom code.

  • Will this code return a "access denied" for the "user/" url? I need this.
    – chefnelone
    Commented Sep 24, 2015 at 10:14
  • No, this code will redirect user from "user/" to "my-url". But I could provide a code snippet to return access denied
    – gerzenstl
    Commented Sep 24, 2015 at 12:14


 * Implements hook_url_outbound_alter().
function custom_module_url_outbound_alter(&$path, &$options, $original_path) {
  // Alter paths for login and sign-up pages.
  if ($path === 'user/login' || $path === 'user/sign-up') {
    $path = 'omfg';

Not the answer you're looking for? Browse other questions tagged or ask your own question.