2

I've shut down password resets for all users.

I now need to prevent /wp-login.php?action=lostpassword from doing anything should anyone manually input the URL into their browser.

i.e. I don't want the password reset form to show.

Can I disable the action that's being passed by the URL or can I redirect /wp-login.php?action=lostpassword to /wp-login.php?

| improve this question | | | | |
5

Hi Please try to use this in your functions.php it will redirect user to login form when user try to access lost password page:

add_action('init','possibly_redirect'); 
function possibly_redirect(){ 
   if (isset( $_GET['action'] )){  
     if ( in_array( $_GET['action'], array('lostpassword', 'retrievepassword') ) ) {
        wp_redirect( '/wp-login.php' ); exit;
     }
  }
}

Or Please follow below approach used from this answer answered here with some details based on comments of @Clarus Dignus

function disable_lost_password() {
    if (isset( $_GET['action'] )){
        if ( in_array( $_GET['action'], array('lostpassword', 'retrievepassword') ) ) {
            wp_redirect( wp_login_url(), 301 );
            exit;
        }
    }
}
add_action( "login_init", "disable_lost_password" );
| improve this answer | | | | |
  • This works. I've since discovered that the retrievepassword action also needs to be conditionally checked for. – Clarus Dignus Jan 20 '16 at 17:35
  • updated answer based on you comment and discovered answer !! – jas Jan 20 '16 at 19:35
  • 2
    Note that you're running this on init where the action GET paramter isn't always set, so we would see PHP notices in many places - isset() would come to the rescue ;-) – birgire Jan 20 '16 at 19:36
  • @birgire I vaguely understand. Am I to check if lostpassword and retrievepassword are isset() before calling them in the array? I've trued to produce the errors you're describing by targeting http://example.com/wp-login.php?action= (i.e. no value for action parameter) but errors aren't being printed to my page. – Clarus Dignus Jan 20 '16 at 20:46
  • 2
    yes that looks ok and it's usually better to narrow the scope as much as we can, so I would try hooks that are more specific than init. (ps: I'm signing off for the evening) @ClarusDignus – birgire Jan 21 '16 at 1:02
1

You can use .htaccess and mod_rewrite.

Forbidden response:

RewriteCond %{QUERY_STRING} ^action=lostpassword$ [NC]
RewriteRule ^wp-login.php$ - [F,NC]

Redirect to wp-login.php:

RewriteCond %{QUERY_STRING} ^action=lostpassword$ [NC]
RewriteRule ^wp-login.php$ wp-login.php [R=301,NC,QSD,L]

(for QSD flag you need Apache 2.4.0+)

| improve this answer | | | | |
1

I know this is an older thread, but I have a couple of improvements. First, since they can use GET or POST, I would be checking for $_REQUEST instead of $_GET

Second, redirect them somewhere useless, instead of back to your site. Like 'http://127.0.0.1' If they don't have a web server there, the bot will at least stall for a few seconds waiting for a reply. Anything we can do to hinder these a-holes.

| improve this answer | | | | |
  • not a coder myself but just found this needed solution, can you elaborate on using $_REQUEST instead of $_GET? Does that mean I would just replace each instance of $_GET in the code above where it's shown in if(isset and if(in_array ? Or does the code change other than the replacement? – Trisha May 31 '19 at 0:21
  • $_REQUEST combines $_GET, $_POST and $_COOKIE. Which takes precedence if two have the same keyed value, will depend on your php setup – De Coder Jun 1 '19 at 4:10
  • Thank you @de-coder, that is very helpful but so that I fully understand, would I then use the code from above modified like so: 'function disable_lost_password() { if (isset( $_REQUEST['action'] )){ if ( in_array( $_REQUEST['action'], array('lostpassword', 'retrievepassword') ) ) { wp_redirect( wp_login_url(), 301 ); exit; } } } add_action( "login_init", "disable_lost_password" );' – Trisha Jun 2 '19 at 20:46
  • 1
    You are using $_REQUEST correctly there. Just use it instead of $_GET and it watches for $_GET and $_POST at the same time, saving a little code. – De Coder Jun 4 '19 at 1:15
  • thank you very much! I'm so grateful that you and others are generous with your time and experience. :-) – Trisha Jun 4 '19 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.