1

Can I create a login page, which could be entered all registered visitors, but were not allowed entrance to the administrator, even if he has entered the correct username and password? For admin I want to have a different login page with a secret address. I have a shop at the base of the plugin Woocommerce. Its login page is often subjected to brute force attack and I'm worried that it will soon break.

  • You can try Rename wp-login.php plugin to rename the admin folder name. Change it to your secret name as you wish. I have used in several sites and works nice. Plugin link – Nilambar Oct 27 '14 at 4:07
  • 1
    @Nilambar, the only security that plugin gives is a false sense of security – Mark Kaplun Oct 27 '14 at 6:12
  • @MarkKaplun Isn't it better to hide wp-admin so it hard to guess the admin page? – Nilambar Oct 27 '14 at 6:18
  • 1
    lets assume you could actually do it without breaking your site, how does it help to protect against attacks via xml-rpc? – Mark Kaplun Oct 27 '14 at 6:26
1

Login pages are not made of wood and continuous attacks do not weaken them. The whole point of having strong passwords is that however many attacks are performed against the user the probability of successful guess in your lifetime is zero. Best way to protect your user accounts are by having strong password.

If you believe strong passwords are not practical for your admins (or that they are too lazy to use them) you might want to force them to use things like google authenticator app which runs on their smartphone and produces verification code for them to use on login (one plugin that integrates with it - https://wordpress.org/plugins/google-authenticator/)

Back to the question, yes you can have several different login forms, and check the capabilities of user associated with the login name and if he doesn't have the manage_options capability and based on that decide whether to continue the login process or not depending on the form you are handling at that moment.

1

If you know the IP address range of the 'super-admin' types that you want to allow login for, you could modify a copy of the login page to check for that IP.

But, unless you are getting tons of attacks that are slowing down the site, I am not sure that is worth the effort...again, assuming strong passwords are being used, as mentioned by @MarkKaplun.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.