5 deleted 237 characters in body
source | link

I came up with a solution for moving the Wordpress login from /login/, /wp-admin/ or /wp-login.php to /cms using only .htaccess rewrite rules.

No plugin needed!

Paste this into the .htaccess file of the root of the project:

<IfModule mod_rewrite.c>
    RewriteEngine on
    RewriteBase /
    # Move Wordpress login to /cms.
    RewriteRule ^cms wp-login.php?cms=unlocked [L]
    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{QUERY_STRING} !^cms=unlocked
    RewriteCond %{QUERY_STRING} !^action=logout
    RewriteCond %{QUERY_STRING} !^loggedout=true
    RewriteCond %{REQUEST_METHODHTTP_REFERER} !POST
    RewriteRule ^/cms(.*)$ 
 - [R=403,L]

    RewriteCond %{REQUEST_URIREQUEST_METHOD} ^(.*)?wp-login\.php(.*)$POST
    RewriteCond %{QUERY_STRING} ^loggedout=true
    RewriteRule ^(.*) ./cms?message=wrong_login_path [R=302,NC,L]
 
      RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
      RewriteCond %{HTTP_REFERERQUERY_STRING} !cms$^cms=unlocked
      RewriteCond %{REQUEST_METHOD} !POST
      RewriteRule ^(.*)$ -./cms?message=redirect_to_custom_login_path [R=403[R=302,L]
      RewriteRule ^cms wp-login.php?cms=unlocked [L]
</IfModule>

Cheers!

Update: I improved some rules so even the POST requests to /wp-login.php will trigger a 403 forbidden error. This will help against bots that are trying to login to the dashboard using brute-force methods. Feel free to comment on this post if you have any improvements to these rules.

I came up with a solution for moving the Wordpress login from /login/, /wp-admin/ or /wp-login.php to /cms using only .htaccess rewrite rules.

No plugin needed!

Paste this into the .htaccess file of the root of the project:

<IfModule mod_rewrite.c>
    RewriteEngine on
    RewriteBase /
    # Move Wordpress login to /cms.
    RewriteRule ^cms wp-login.php?cms=unlocked [L]
    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{QUERY_STRING} !^cms=unlocked
    RewriteCond %{QUERY_STRING} !^action=logout
    RewriteCond %{QUERY_STRING} !^loggedout=true
    RewriteCond %{REQUEST_METHOD} !POST
    RewriteRule ^(.*)$ - [R=403,L]

    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{QUERY_STRING} ^loggedout=true
    RewriteRule ^(.*) ./cms? [R=302,NC,L]
 
    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{HTTP_REFERER} !cms$
    RewriteCond %{REQUEST_METHOD} POST
    RewriteRule ^(.*)$ - [R=403,L]
</IfModule>

Cheers!

Update: I improved some rules so even the POST requests to /wp-login.php will trigger a 403 forbidden error. This will help against bots that are trying to login to the dashboard using brute-force methods. Feel free to comment on this post if you have any improvements to these rules.

I came up with a solution for moving the Wordpress login from /login/, /wp-admin/ or /wp-login.php to /cms using only .htaccess rewrite rules.

No plugin needed!

Paste this into the .htaccess file of the root of the project:

<IfModule mod_rewrite.c>
      # Move login to /cms.
      RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
      RewriteCond %{HTTP_REFERER} !/cms(.*)$ 
      RewriteCond %{REQUEST_METHOD} POST
      RewriteRule ^(.*) ./cms?message=wrong_login_path [R=302,L]
      RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
      RewriteCond %{QUERY_STRING} !^cms=unlocked
      RewriteCond %{REQUEST_METHOD} !POST
      RewriteRule ^(.*) ./cms?message=redirect_to_custom_login_path [R=302,L]
      RewriteRule ^cms wp-login.php?cms=unlocked [L]
</IfModule>

Cheers!

Update: I improved some rules so even the POST requests to /wp-login.php will trigger a 403 forbidden error. This will help against bots that are trying to login to the dashboard using brute-force methods. Feel free to comment on this post if you have any improvements to these rules.

4 added 5 characters in body
source | link

I came up with a solution for moving the Wordpress login from /login/, /wp-admin/ or /wp-login.php to /cms using only .htaccess rewrite rules.

No plugin needed!

Paste this into the .htaccess file of the root of the project:

<IfModule mod_rewrite.c>
    RewriteEngine on
    RewriteBase /
    # Move Wordpress login to /cms.
    RewriteRule ^cms /wp-login.php?cms=unlocked [L]
    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{QUERY_STRING} !^cms=unlocked
    RewriteCond %{QUERY_STRING} !^action=logout
    RewriteCond %{QUERY_STRING} !^loggedout=true
    RewriteCond %{REQUEST_METHOD} !POST
    RewriteRule ^(.*)$ - [R=403,L]

    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{QUERY_STRING} ^loggedout=true
    RewriteRule ^(.+$*) ./cms? [R=302,NC,L]

    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{HTTP_REFERER} !/cms$
    RewriteCond %{REQUEST_METHOD} POST
    RewriteRule ^(.*)$ - [R=403,L]
</IfModule>

Cheers!

Update: I improved some rules so even the POST requests to /wp-login.php will trigger a 403 forbidden error. This will help against bots that are trying to login to the dashboard using brute-force methods. Feel free to comment on this post if you have any improvements to these rules.

I came up with a solution for moving the Wordpress login from /login/, /wp-admin/ or /wp-login.php to /cms using only .htaccess rewrite rules.

No plugin needed!

Paste this into the .htaccess file of the root of the project:

<IfModule mod_rewrite.c>
    RewriteEngine on

    # Move Wordpress login to /cms.
    RewriteRule ^cms /wp-login.php?cms=unlocked [L]
    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{QUERY_STRING} !^cms=unlocked
    RewriteCond %{QUERY_STRING} !^action=logout
    RewriteCond %{QUERY_STRING} !^loggedout=true
    RewriteCond %{REQUEST_METHOD} !POST
    RewriteRule ^(.*)$ - [R=403,L]

    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{QUERY_STRING} ^loggedout=true
    RewriteRule ^.+$ /cms? [R=302,NC,L]

    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{HTTP_REFERER} !/cms$
    RewriteCond %{REQUEST_METHOD} POST
    RewriteRule ^(.*)$ - [R=403,L]
</IfModule>

Cheers!

Update: I improved some rules so even the POST requests to /wp-login.php will trigger a 403 forbidden error. This will help against bots that are trying to login to the dashboard using brute-force methods. Feel free to comment on this post if you have any improvements to these rules.

I came up with a solution for moving the Wordpress login from /login/, /wp-admin/ or /wp-login.php to /cms using only .htaccess rewrite rules.

No plugin needed!

Paste this into the .htaccess file of the root of the project:

<IfModule mod_rewrite.c>
    RewriteEngine on
    RewriteBase /
    # Move Wordpress login to /cms.
    RewriteRule ^cms wp-login.php?cms=unlocked [L]
    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{QUERY_STRING} !^cms=unlocked
    RewriteCond %{QUERY_STRING} !^action=logout
    RewriteCond %{QUERY_STRING} !^loggedout=true
    RewriteCond %{REQUEST_METHOD} !POST
    RewriteRule ^(.*)$ - [R=403,L]

    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{QUERY_STRING} ^loggedout=true
    RewriteRule ^(.*) ./cms? [R=302,NC,L]

    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{HTTP_REFERER} !cms$
    RewriteCond %{REQUEST_METHOD} POST
    RewriteRule ^(.*)$ - [R=403,L]
</IfModule>

Cheers!

Update: I improved some rules so even the POST requests to /wp-login.php will trigger a 403 forbidden error. This will help against bots that are trying to login to the dashboard using brute-force methods. Feel free to comment on this post if you have any improvements to these rules.

3 added 297 characters in body
source | link

I came up with a solution for moving the Wordpress login from /login/, /wp-admin/ or /wp-login.php to /cms using only .htaccess rewrite rules.

No plugin needed!

Paste this into the .htaccess file of the root of the project:

<IfModule mod_rewrite.c>
    RewriteEngine on

    # MovesMove Wordpress login to /cms.
    RewriteRule ^cms /wp-login.php?cms=unlocked [L]
    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{QUERY_STRING} !^cms=unlocked
    RewriteCond %{QUERY_STRING} !^action=logout
    RewriteCond %{QUERY_STRING} !^loggedout=true
    RewriteCond %{REQUEST_METHOD} !POST
    RewriteRule ^(.*)$ - [R=403,L]

    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{QUERY_STRING} ^loggedout=true
    RewriteRule ^.+$ /cms? [R=302,NC,L]

    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{HTTP_REFERER} !/cms$
    RewriteCond %{REQUEST_METHOD} POST
    RewriteRule ^(.*)$ - [R=403,L]
</IfModule>

Cheers!

Update: I improved some rules so even the POST requests to /wp-login.php will trigger a 403 forbidden error. This will help against bots that are trying to login to the dashboard using brute-force methods. Feel free to comment on this post if you have any improvements to these rules.

I came up with a solution for moving the Wordpress login from /login/, /wp-admin/ or /wp-login.php to /cms using only .htaccess rewrite rules.

No plugin needed!

Paste this into the .htaccess file of the root of the project:

<IfModule mod_rewrite.c>
    # Moves Wordpress login to /cms.
    RewriteRule ^cms /wp-login.php?cms=unlocked [L]
    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{QUERY_STRING} !^cms=unlocked
    RewriteCond %{QUERY_STRING} !^action=logout
    RewriteCond %{QUERY_STRING} !^loggedout=true
    RewriteCond %{REQUEST_METHOD} !POST
    RewriteRule ^(.*)$ - [R=403,L]

    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{QUERY_STRING} ^loggedout=true
    RewriteRule ^.+$ /cms? [R=302,NC,L]

    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{HTTP_REFERER} !/cms$
    RewriteCond %{REQUEST_METHOD} POST
    RewriteRule ^(.*)$ - [R=403,L]
</IfModule>

Cheers!

I came up with a solution for moving the Wordpress login from /login/, /wp-admin/ or /wp-login.php to /cms using only .htaccess rewrite rules.

No plugin needed!

Paste this into the .htaccess file of the root of the project:

<IfModule mod_rewrite.c>
    RewriteEngine on

    # Move Wordpress login to /cms.
    RewriteRule ^cms /wp-login.php?cms=unlocked [L]
    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{QUERY_STRING} !^cms=unlocked
    RewriteCond %{QUERY_STRING} !^action=logout
    RewriteCond %{QUERY_STRING} !^loggedout=true
    RewriteCond %{REQUEST_METHOD} !POST
    RewriteRule ^(.*)$ - [R=403,L]

    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{QUERY_STRING} ^loggedout=true
    RewriteRule ^.+$ /cms? [R=302,NC,L]

    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$
    RewriteCond %{HTTP_REFERER} !/cms$
    RewriteCond %{REQUEST_METHOD} POST
    RewriteRule ^(.*)$ - [R=403,L]
</IfModule>

Cheers!

Update: I improved some rules so even the POST requests to /wp-login.php will trigger a 403 forbidden error. This will help against bots that are trying to login to the dashboard using brute-force methods. Feel free to comment on this post if you have any improvements to these rules.

2 deleted 325 characters in body
source | link
1
source | link