WordPress admin_url Example: Build Dashboard Links Correctly

Last reviewed: May 8, 2026

Hardcoding dashboard links is a quiet reliability bug. It works on one install, then fails under SSL changes, subdirectory setups, multisite context, or admin routing differences the code did not account for. admin_url() is the supported helper for building links into the WordPress admin area of the current site.

This guide shows how to generate dashboard URLs correctly and when to let the helper control the final scheme.

Build admin destinations from the admin helper, not from string concatenation

<?php
$settings_url = admin_url( 'options-general.php?page=vulnwp-settings' );

echo '<a href="' . esc_url( $settings_url ) . '">'
	. esc_html__( 'Open plugin settings', 'vulnwp' )
	. '</a>';

The helper keeps the link anchored to the actual admin base for the current site. That is safer than appending paths onto guessed host values or public URLs.

Use the scheme argument only when you have a real reason

admin_url() defaults to the admin scheme behavior, which follows WordPress SSL rules such as force_ssl_admin() and the current request context. Explicit http or https should be reserved for cases where the output contract truly requires it.

Keep admin links separate from public and REST links

One recurring bug pattern is using the wrong URL helper everywhere. Public navigation belongs on helpers like home_url(). API roots belong on rest_url(). Admin destinations belong on admin_url(). The distinction matters because these surfaces do not always share the same final URL base.

Common mistakes

• Appending /wp-admin/ to a public URL manually. This is brittle.
• Using home_url() for dashboard links. Public and admin surfaces are different.
• Forcing a scheme without need. Let WordPress apply its admin SSL policy by default.
• Skipping final output escaping. Canonical generation and HTML output safety are separate concerns.

Production checklist

• Use admin_url() for dashboard links and admin page redirects.
• Escape the final rendered URL with esc_url().
• Keep admin, public, and REST URL helpers on separate paths.
• Retest links after SSL, proxy, multisite, or path changes.
• Avoid host concatenation for internal admin navigation.

Related reading

Pair this with the home_url guide for public links and with the rest_url article when the destination is an API route instead of a dashboard page.

References and further reading

• WordPress Code Reference: admin_url()
• WordPress Hook Reference: admin_url filter
• WordPress Code Reference: esc_url()