I'm trying to be sneaky with iis to secure a wordpress login page (not my choice to run a windows server, but that's the reality of things). It's worked so far, only the login page itself loads itself before forwarding you to the admin panel so after a successful (or unsuccessful) login the first rule kicks in and sends you to the dummy page. My rules so far:
<rule name="redirect" patternSyntax="ECMAScript"> <match url="^installbase/wp-login\.php" /> <action type="Rewrite" url="installbase/index.php?page=403-forbidden" /> </rule> <rule name="login" patternSyntax="ECMAScript"> <match url="^sneakyURLforLoggingIn" /> <action type="Rewrite" url="installbase/wp-login.php" /> </rule>
1: I'm sure there's a more efficient way to do this
2: once wordpress accepts the login it sends you to the 403 page, requiring the user to then manually navigate to /wp-admin/. That's less than ideal.
Any thougths on how to solve this catch-22? Or is there a better way to accomplish the same thing?