描述
Block wp-login.php and use a secret login URL
Block wp-login prevents automated requests from reaching the default WordPress login endpoint. It creates a secret login URL for authorised users and adds Apache rewrite rules that return a 403 Forbidden response for direct requests to wp-login.php.
Because blocked requests are rejected before WordPress loads, the plugin can reduce the server resources consumed by bots repeatedly targeting wp-login.php.
Features include:
- Choose your own secret login slug or generate a random one.
- Block direct access to the default wp-login.php endpoint with a 403 response.
- Continue to support password resets, registration and WordPress administration email verification through the secret login URL.
- Rebuild the secret login file after a WordPress core update.
- Optionally email administrators when the login URL changes.
- Optionally notify the site owner when an administrator signs in from an IP address that is not on the known-IP list.
Important compatibility information
Block wp-login requires an Apache web server with mod_rewrite and a writable .htaccess file in the WordPress root directory. It is not compatible with Nginx or servers that do not honour .htaccess rules.
Hiding the default login endpoint reduces automated login traffic, but it is not a replacement for strong passwords, two-factor authentication, updates, backups or other appropriate security controls.
安裝
Before installing, confirm that the site runs on Apache and that WordPress can write to its root directory and .htaccess file.
- Install Block wp-login from Plugins > Add New, or upload the plugin ZIP file.
- Activate the plugin.
- Go to Settings > Permalinks and find the Block wp-login section.
- Enter a memorable login slug using letters and numbers, or generate a random one.
- Select the administrator notification option if you want the new login URL sent by email.
- Save the Permalink settings.
- Copy and bookmark the displayed login URL.
- Keep your current administrator session open while you test the new URL in a private or incognito browser window.
After configuration, direct requests to wp-login.php should return 403 Forbidden. Use the secret URL for login, registration and password-reset requests.
常見問題
-
What is wp-login.php?
-
wp-login.php is the standard WordPress endpoint for login, registration and password-reset requests. Its predictable location is frequently targeted by automated bots.
-
Does this plugin stop every brute-force attack?
-
No. It blocks automated traffic aimed at the default wp-login.php address and can reduce the associated server load. If someone discovers the secret login URL, normal WordPress authentication still applies. Use strong unique passwords and other suitable security controls as well.
-
Does it work with Nginx?
-
No. Block wp-login relies on Apache mod_rewrite and .htaccess. Do not activate it on Nginx or another server that does not process Apache .htaccess rules.
-
Can users reset their passwords or register?
-
Yes. Password-reset emails, reset forms and registration links use the secret login URL. WordPress administration email verification is also supported.
-
What happens after a WordPress core update?
-
The plugin detects a changed WordPress version and rebuilds its secret copy of the current wp-login.php file. If the server is overloaded, it safely defers that work until a later administrator request.
-
What should I do if I forget the secret login URL?
-
First check the notification email sent when the URL was configured. If you have command-line access, deactivating the plugin with WP-CLI runs its cleanup routine and restores the default login endpoint. Otherwise, ask your hosting provider or developer to remove the section between
# BEGIN BlockWPLoginand# END BlockWPLoginfrom the WordPress .htaccess file before deactivating the plugin. Take a backup before editing .htaccess. -
How do I return to the standard WordPress login URL?
-
Go to Settings > Permalinks, clear the Login address field and save the settings, or deactivate the plugin normally. The plugin removes its rewrite rules and generated login file.
評價
貢獻者及開發者
修改日誌
1.5.7
- Added support for the forthcoming Deny All Firewall 2.0 rules-refresh action.
- Added an administrator notice when the Deny All Firewall 2.0 update is available.
- Deferred core-update reinstalls while the server is overloaded.
- Hardened filesystem operations and prevented reminder emails before a successful reinstall.
1.5.6
- Fix a minor issue highlighted by “Plugin Check” code review and preparing for WordPress v7.0
1.5.5
- Fix a minor bug and general housekeeping preparing for “Plugin Check” code review
1.5.4
- Updated race condition prevention when WordPress core version changes
1.5.3
- I18N issues resolved thanks to Alex Lion @alexclassroom and added a transient check to prevent a race condition when WordPress core is updated
1.5.2
- General housekeeping
1.5.1
- Added an option to email the site admin if an administrator signs in with an un-recognised IP address
- Added translation strings
1.5
- General housekeeping
1.4.9
- Fixed bug that causes an error if the login_url hook is fired early
1.4.8
- Preparing for WordPress v6.0
1.4.7
- Fixed a cookie related bug with Google Chrome preventing login
1.4.6
- Fixed bugs when .htaccess cannot be opened
- Removed all PHP short tags
1.4.5
- Preparing for WordPress v5.8
1.4.4
- General housekeeping
1.4.3
- General housekeeping
1.4.2
- Added an option to send login URL reminders when saving Permalink settings
1.4.1
- Added random login generator.
1.4.0
- Premium functionality is now free!
1.3.9
- Bug fix
1.3.8
- Removed functionality now dealt with by Deny All Firewall
1.3.7
- Yet more fixes for compatibility with WordPress 5.3
1.3.6
- Further fixes for compatibility with WordPress 5.3
1.3.5
- Fixed a bug that blocked Admin Email Verification in WordPress 5.3
1.3.4
- Integrated plugin with new Deny All Firewall plugin
1.3.3
- Plugin now allows password protected posts and pages to work
1.3.2
- Important security update
1.3.1
- Important security update
1.3.0
- Automated upgrade activation facility
- Bug fixes
1.2.4
- Bug fix
1.2.3
- Updating new developer / activation domain
- Updating tested version
1.2.2
- Bug fixes.
1.2.1
- WordPress upgrade email re-worded
1.2.0
- Plugin now automatically detects when WordPress has been upgraded and re-installs itself.
- Bug fixed for when wp_mail() isn’t working
1.1.7
- Bug fixes.
1.1.6
- Plugin now upgrades automatically when activated if licensed.
1.1.5
- Plugin is now internationalised ready for translation.
- Help banner admin notice now appears until plugin has been configured.
- Added help links on the settings page and added this information to the FAQ.
- Minor bug fixes.
1.1.4
- Blocking admin-ajax.php now allows commands when inniated from /wp-admin/.
- Blank user or site owner emails won’t break saving settings.
- Duplicate emails are not sent now when site owner and user email addresses are the same.
- Options to block admin-ajax.php, wp-cron.php, xmlrpc.php and robots.txt are disabled until wp-login.php block is activated.
1.1.3
- Plugin now emails all Administrators and the email set in General Settings with the new login URL.
1.1.2
- Added option to block admin-ajax.php, wp-cron.php, xmlrpc.php and robots.txt for the free plugin.
1.1.1
- Bug fixes.
- Option to block wp-cron.php, admin-ajax.php and robots.txt for upgraded plugin.
1.1.0
- Plugin re-written to make use of “Settings – Permalinks” so upgraded plugin can choose custom login slug.
- Plugin now reverses changes when deactivated.
- Plugin creates random login slug.
1.0.0
- First, beta version of the plugin.