Login redirects and query strings

Question

I have a number of sites that every so often become the subject of multiple IP address brute force attacks. I use the wonderful Limit Login Attempts which rebounds them but the logging is a pain in the arse, not to mention the drain on server resource. Especially as some attacks are either IP spoofing or have access to a huge number.

So I've modified a piece of code that adds a query string to the login (thanks to https://gist.github.com/williejackson) and made it into a 'quick-response' plugin that I can put onto sites currently the subject of attack.

Essentially it works by adding a query variable to /wp-login.php eg /wp-login.php?question=answer

My question is what happens to the redirects?

There is /wordpress/wp-admin or /wp-admin and the one I use a lot is /admin (it's this I give out to clients as it's so user-friendly) neither of which pass the query string.

I'm also curious; I can find no reference anywhere to /admin - someone's great idea in the mists of time? - and it's not clear where to hook into the redirect for wp-admin to preserve the query strings.

As it stands, this piece of code (I'll attach it below) is only useful temporarily as an emergency fix as it also destroys any other login functionality such as Lost Password or Failed Login but I'm tempted to develop it further to deal with these instances.

<?php
/*
* Check the URL of the WordPress login
* page for a specific query string
*
* assumes login string is
* http://example.com/wp-login.php?question=answer
*/
function rkv_login_stringcheck() {
    // set the location a failed attempt goes to
    $redirect = 'http://www.google.com/';
    // missing query string all together
    if (!isset ($_GET['question']) )
        wp_redirect( esc_url_raw ($redirect), 302 );
    // incorrect value for query string
    if ($_GET['question'] !== 'answer' )
        wp_redirect( esc_url_raw ($redirect), 302 );
}
add_action( 'login_init', 'rkv_login_stringcheck' );

Answer 1

There is /wordpress/wp-admin or /wp-admin and the one I use a lot is /admin (it's this I give out to clients as it's so user-friendly) neither of which pass the query string.

If I understand what you're getting at, I think what you're looking for is how the wp_redirect_admin_locations() function is used.

This is a canonical function that defines the admin locations and handles the redirects based on the requested URLs.

WP applies this function hooked to template_redirect, with a priority of 1000. That means anyone who just applies a revised version of this an uses the default priority for an action hook (10), the custom version will kick in and redirect the user. Simply put - you can write your own version of it and handle passing any necessary query strings.

// WP's default
add_action( 'template_redirect', 'wp_redirect_admin_locations', 1000 ); 

// At default priority, your custom version will kick in before WP's.
add_action( 'template_redirect', 'my_custom_redirect_admin_locations' );

(Note: I left out any specific of writing a custom version of the wp_redirect_admin_locations() function as it seems you probably have a handle on how to do that already. Also, I would suggest that there be some leeway in any custom handling to allow execution to continue and the default to ultimately be hit if there is no custom case applied.)