Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

It can be another layer of security..

share|improve this question
    
Read it before answering: I want to move login page physically (not virtually). Please, suggest a plugin way to do this which could alter core codes on fly (even after core code update). –  Sachin Shekhar Feb 23 '11 at 6:47
    
You can also try this plugin: wordpress.org/extend/plugins/ozh-simpler-login-url –  wpmayor Mar 18 '11 at 22:10
2  
Did you come to a conclusion about this Question? What about the top voted Answers? –  brasofilo Jul 21 '12 at 11:47
add comment

9 Answers

You could try editing the .htaccess and perform a redirect to another path of your convenience.

share|improve this answer
    
Are you talking about URL Rewrite using .htaccess? Isn't it break internal core functions? –  Sachin Shekhar Feb 23 '11 at 6:15
    
Well... if you do it correctly doesn't need to break anything. Reading your update I will suggest rename (or move) your login things to another directory/path. What do you have in mind? Another sub-domain? or just another path? –  konus Feb 23 '11 at 15:40
    
Just another path.. –  Sachin Shekhar Feb 25 '11 at 22:01
    
Well then you can do a Search&Replace in all the wordpress files, then rename the files who has the same pattern, and then rename the folder wp-admin. Its a little bit tricky and you will be attached to that version (any update, will broke this changes) –  konus Feb 26 '11 at 6:57
add comment

This isn't a great security idea because the wp-login or wp-admin page in of itself does not pose a security threat. Though it can be argued that if someone had your password/username they might not be able to find where to login, thus security through obscurity.

As kronus said you could probably to some fancy re-directs, not sure how well that would scale with future releases or if it is even worth the trouble, personally I don't think its worth it and I take security seriously.

I would suggest some better ideas for your login.

Enable ssl for the login/admin (htpps).

Password protect your page using .htaccess ( so you will have a double login).

Use a plugin like Limit Login Attempts, which locks out a user after failed logins.

share|improve this answer
    
Thanks for your nice suggestions, but I want to move login page to another location. –  Sachin Shekhar Feb 23 '11 at 6:42
1  
It's absolutely a good idea. Hiding the fact that your site is driven by wordpress discourages people from trying to hack the core structure. If I was trolling for wordpress blogs and www.site.com/wp-login.php and came up with a 404 error I would move on without trying to break through known php exploits. Every bit of security helps make your site that much more bulletproof. –  Kristina Childs Dec 14 '12 at 19:55
1  
And a known core exploit would be? Ya you don't have or know of any, so your talking for nothing. Security professional actually secure applications and don't hide things, that's for children. –  Wyck Dec 14 '12 at 20:22
1  
I never said core exploits. There are hacks-a-plenty for wordpress plugins, themes, etc. Just take a look at any exploit reporting site. Looking at the failed http request logs, sites I manage get brute force and XSS attacks tailored for wordpress all day, every day. By your logic, you also shouldn't move wp-content outside of the root install folder, wp-config.php above the root folder, remove "powered by wordpress" in the page footer, change the default wp_ table prefix or delete the default admin account. Modifying defaults is securing, and the login page is no different. –  kristina childs Apr 24 '13 at 22:38
add comment

You can disable the wp-login page from your functions by hooking into login_head:

add_action( 'login_head', 'wp_die');

(that's obviously a very clumsy way of doing it, but it prevents anyone from being able to login through that page. You could make that a redirect function, or a warning message, rather than just a die.)

And copy the existing wp-login file to another location, making sure to update the relative path to wp-load.php near the top (and any other relative paths that may be in there, including the links to itself and the form actions.

(Obviously you'll have to remove the action that you added to login_head here, otherwise you won't be able to login from this page either.)

Then, you should just need to add a filter to login_url that returns the address of your new login page, otherwise people requesting wp-admin files will be redirected to the old login page, which is now disabled.

share|improve this answer
add comment

Just build out new login pages in subdirs. Copy the existing wp-login page into a new directory in your webroot (maybe "/login"), rename it index.php, add a WordPress bootstrap to the top of the page, and do whatever you like with it (theming, etc).

You do have to adjust the login page's default code a bit, mostly to find/replace for hardcoded links and redirects to "wp-login.php". But as long as you leave all the hooks and filters in place, this approach won't mess up any plugin integration. And WordPress core updates are fine, unless the update includes changes to the wp-login page itself (which rarely happens in minor versions).

You can also build out user account pages this way (I put them in the dir "/profile"). Once you've done that, subscriber-level users should never need to go into wp-admin, so you can protect it with an htaccess file. This is the part that actually gives you the added security you were looking for. Just be sure to make an exception in your htacces for the admin-ajax file, since some plugins use it on the frontend.

Pretty sure you're not going to find a plugin-only solution. But if you do, let us know!

share|improve this answer
add comment

I solved this problem by deleting three of my blogs and changing the parameters of limit-login to the maximums possible. 9999

For the one scum spammer at 208.91.199.94 who has hit my login page 750 times in the last two days, I am working on eliminating him other ways.

share|improve this answer
add comment

You could use this plugin:

http://wordpress.org/extend/plugins/wp-login/

You can just create a page and tell the plugin that's where the login is. But all it basically does is redirect wp-login.php to your "page". So any bot searching for wp-login.php will just be redirected to your "page".

To protect you login page from bots you should use a combination of a cookie and .htaccess as most bots don't use cookies. Something like this:

RewriteCond %{HTTP_COOKIE} !^PHPSESSID=\w+ [OR]
RewriteCond %{HTTP_REFERER} !^https?://([^.]+\.)?example\.com/ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule ^wp-(comments-post|login|register)\.php http://example\.com [R=301,L,NS]

In the example above I'm using a PHP Session Cookie, since it's the easiest to implement.

share|improve this answer
add comment

None of these answers were especially useful. I question the motives of the OP, but here is how to do it. Add this to your functions.php, but make sure to replace "$login_page_id":

// This will redirect the actual login page to your new page
add_action( 'login_redirect', 'custom_login_redirect' );
function custom_login_redirect()
{
    if ( 'wp-login.php' == $GLOBALS['pagenow'] )
    {
        // Set your $login_page_id
        wp_redirect( get_permalink($login_page_id) );
        die;
    }
}

// This will replace the login url used by Wordpress
add_filter( 'login_url', 'custom_login_url', 10, 2 );
public function custom_login_url( $login_url='', $redirect='' )
{
    // Set your $login_page_id
    return get_permalink($login_page_id);
}

On your new login page, you can simply add this function to show a login form:

<?php wp_login_form(); ?>

http://codex.wordpress.org/Function_Reference/wp_login_form

share|improve this answer
add comment

To modify logout URL (in admin) edit your functions.php:

add_filter( 'logout_url', 'custom_logout_url');
function custom_logout_url( $login_url)
{
   $url = str_replace( 'wp-login', 'your_logout_file', $login_url );
   return $url;
}
share|improve this answer
add comment

I highly resent most of the answers given here. The OP posted a valid question and most of the answers given were intended to evade the fact that they don't have an idea how to get around Wordpress' limitation on this issue.

OP, the best thing you could for this matter is IP filtering and allow only those networks that are allowed to login to the WP-Admin area (e.g. your office IP, developers' IP, etc.). You won;t be doing your work in Starbucks anyway. This is how corporate networks do it, so you might as well do the same.

## .htaccess inside the wp-admin folder
order deny,allow
deny from all
allow from xxx.xxx.xxx
allow from xxx.xxx.xxx
allow from xxx.xxx.xxx
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.