2

My website has recently come under attack by a wave of spam user accounts. My website uses a custom login that forces users to use their email address as their username, however the spam users all have regular usernames so I am assuming they are running a script which sends POST requests to /wp-login.php.

It is not enough to remove this page I need to disable the ability to make user accounts via POST requests to this page as I'm pretty sure the spammers are using software and not hand crafting these accounts.

Lastly I need to disable /wp-admin/profile.php as I believe they are creating accounts to insert back-links into their profiles.

How would I go about doing this?

Improve this question
4
  • go to your wordpress setting and in general option uncheck the Membership that anyone can register on site it will dissable the registration process for site you can active any time by checking this checkbox again
    – Vikas Gautam
    Sep 17, 2013 at 8:57
  • @Vickey, disable the resgitration when the site needs it is not a solution from my point of view.
    – cybmeta
    Sep 17, 2013 at 9:03
  • @Vickey Thanks but I want users to register using my custom login and registration pages (which use wordpress functions to do so) I just want to block these pages which create vulnerabilities. Answer has been found and posted.
    – George Reith
    Sep 17, 2013 at 9:04
  • yes i know but for current you can use it after that you can user secure register wordpress plugins or adding captcha to filter the spam user
    – Vikas Gautam
    Sep 17, 2013 at 9:05

1 Answer 1

Reset to default
1

I realised this is probably better dealt by the server, I ended up putting the following in a .htaccess:

# Block regular login/registration and profile pages
<Files wp-login.php>
    Order Deny,Allow
    Deny from All
</Files>
<Files profile.php>
    Order Deny,Allow
    Deny from All
</Files>

This prevents any requests to those pages and forces users to use my custom login and registration pages.

Edit: I don't think I made this clear and I do not recommend this solution to most WordPress users.

I have a custom user registration, login and profile system. These do not extend the default WordPress ones but are completely stand-alone and do not require access to these pages as all logic and requests are handled by the system itself and not passed on (However they do use WordPress functions and the default user table in the WordPress database).

This is not the same as say a plugin which provides a custom login page just to change the theme but actually sends POST requests back to wp-login.php as this would break under my solution.

Improve this answer
2
  • Is your solution really working? What if you need to login to the admin area?
    – cybmeta
    Sep 17, 2013 at 9:04
  • 1
    @cybnet I have a custom login page (at a different location). This just removes the default one which was being easily spammed.
    – George Reith
    Sep 17, 2013 at 9:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.