Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Is there a way to prevent visitors, whether logged in or not, from reaching mysite.com/wp-login.php?

I have a separate login form which is all we need. I know I can re-style the form generated by wp-login but I'd rather not have to deal with it at all. I've tried various filters and hooks and I can't seem to get it to redirect. I also tried using a .htaccess redirect and I found that this works, but then it prevents my custom login/logout form from working.

Ideas?

share|improve this question
    
are you doing this for security reasons? why not implement auth for wp-login.php only? –  Gaia May 20 '13 at 18:13
    
I don't know what you mean by that. Please expand a bit. TIA. –  jchwebdev May 21 '13 at 18:38
    
WHY do you need a separate login form? for security reasons? –  Gaia May 22 '13 at 1:05
    
We find that too many people these days are aware of the 'wp-login'. We'd rather not have that be quite so obvious. Can you just tell me what 'why not implement auth' means? TIA –  jchwebdev May 22 '13 at 20:09
    
see answer provided. –  Gaia May 22 '13 at 21:47
show 1 more comment

3 Answers

Add a GET var for the logout action and it works fine.

add_action('init','custom_login');

function custom_login(){
 global $pagenow;
 if( 'wp-login.php' == $pagenow && $_GET['action']!="logout") {
  wp_redirect('http://YOURSITE.com/');
  exit();
 }
}
share|improve this answer
add comment

If your intention is to protect wp-login.php from strangers even being able to see it, the simplest efficient way to do so is to require authorization (basic auth) to access wp-login.php.

In Apache, auth is implemented via a combination of htaccess and a password file. The first time, within a browser session, that anyone tries to access wp-login.php they will be prompted to enter an username and password (before the wordpress login).

To simplify things, this username and password can be the same for every person you want to give access to wp-login.php, as they still have to enter their wordpress login after successfully getting past the first the auth dialog box.

share|improve this answer
    
Interesting. I'm assuming the 'prompt' is the browser's modal popup for entering credentials. I think that would cause confusion. Ideally what I want is for that URL to do -nothing-... or perhaps just redirect to the home page. But thanks for that. Learn something new every day! –  jchwebdev May 27 '13 at 2:57
    
What you are think you are doing is "security thru obscurity". But in reality you are only doing obscurity, and that is terrible. Do not use it. Auth is security. Hiding the entrance point is obscurity. security.stackexchange.com/questions/32064/… –  Gaia May 27 '13 at 11:50
1  
In other words, even IF you change the location of wp-login, you still need to use auth: "Should I rely on changing the server from 22 to port 2222 to keep my connection safe? Absolutely not. Is it bad to change my SSH server to port 2222 while also using a password? No, if anything this is the best solution. Changing ("Obscuring") the port will simply cut down on a heap of automatic exploit scanners searching normal ports. We gain a security advantage through obscurity which is good, but we are not counting on the obscurity. If they found it they still need to crack the password." –  Gaia May 27 '13 at 12:41
    
Thanks for that. I learned a lot. Not what I was looking for, but still... very helpful. Best ---JC –  jchwebdev May 31 '13 at 3:51
add comment

Try this in your theme's functions.php

add_action('init','custom_login');

function custom_login(){
 global $pagenow;
 if( 'wp-login.php' == $pagenow ) {
  wp_redirect('http://yoursite.com/');
  exit();
 }
}
share|improve this answer
    
working for me but im having log out issues & cant figure out why –  Aliyah Aug 24 '12 at 3:26
4  
Because wp-login.php handles logging out as well. –  Brian Fegter Aug 24 '12 at 4:02
    
Yeah, this blocks my custom login form. But if there was a way to reliably check for the request var or perhaps referer? IOW: this might be a starting point. Anyone else? TIA ---JC –  jchwebdev Aug 24 '12 at 7:15
    
Ah yes, wp-login does handle logging out. Lol. Thats logical. Perhaps this code with a plugin will suffice. Let me see what else we can use because I hate using wp-login. –  Aliyah Aug 24 '12 at 19:12
    
All I think is necessary would be to monitor the request vars when wp-login is loaded. I just don't have a machine that can do that right now. –  jchwebdev Aug 25 '12 at 0:34
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.