Can I create a login page, which could be entered all registered visitors, but were not allowed entrance to the administrator, even if he has entered the correct username and password? For admin I want to have a different login page with a secret address. I have a shop at the base of the plugin Woocommerce. Its login page is often subjected to brute force attack and I'm worried that it will soon break.
2 Answers
Login pages are not made of wood and continuous attacks do not weaken them. The whole point of having strong passwords is that however many attacks are performed against the user the probability of successful guess in your lifetime is zero. Best way to protect your user accounts are by having strong password.
If you believe strong passwords are not practical for your admins (or that they are too lazy to use them) you might want to force them to use things like google authenticator app which runs on their smartphone and produces verification code for them to use on login (one plugin that integrates with it - https://wordpress.org/plugins/google-authenticator/)
Back to the question, yes you can have several different login forms, and check the capabilities of user associated with the login name and if he doesn't have the manage_options capability and based on that decide whether to continue the login process or not depending on the form you are handling at that moment.
answered Oct 27, 2014 at 5:55
If you know the IP address range of the 'super-admin' types that you want to allow login for, you could modify a copy of the login page to check for that IP.
But, unless you are getting tons of attacks that are slowing down the site, I am not sure that is worth the effort...again, assuming strong passwords are being used, as mentioned by @MarkKaplun.
answered Jan 30, 2017 at 20:28
Rename wp-login.phpplugin to rename the admin folder name. Change it to your secret name as you wish. I have used in several sites and works nice. Plugin linkwp-adminso it hard to guess the admin page?