1

How can I disable wordpress login temporarily even for administrator users? is there any solution?

1
  • Is this just for preventing logging in or does this also cover forcing the logout of all the people that are already authenticated?
    – Tom J Nowell
    May 26 at 16:39

3 Answers 3

3

You could hook into the wp_authenticate_user filter and return an error.

Something like:

add_filter( 'wp_authenticate_user', 'wpse_406123_stop_login', -1 );

function wpse_406123_stop_login() {
    $message = new WP_Error( 'login_disabled', __( '<strong>ERROR</strong>: You cannot login at this time' ) );
    return $message;
}

You can then change your security keys -the ones that look like this to something different - that will invalidate all current logins.

5
  • Didn't noticed you had already posted, deleted mine :-)
    – birgire
    May 26 at 16:30
  • ps: I'm still able to login with your code though, maybe I will undelete mine to test further :-)
    – birgire
    May 26 at 16:35
  • Nice thorough answer below @birgire - upvoted! Did you change the security keys? I've also changed the priority to make sure it runs before anything else. Should help. I will admit to not testing this - this was a codex eye-baller.
    – Bysander
    May 27 at 8:43
  • Thanks @Bysander, it could also be that my test install is not in a got shape and in a need of a total replacement :-)
    – birgire
    May 27 at 10:57
  • 1
    Just tested & changed hook wp_authenticate_user is the right one
    – Bysander
    May 27 at 11:12
1

Here's a way to halt the login by returning an error through the wp_authenticate_user filter:

add_filter( 'wp_authenticate_user', function() {
    return new WP_Error( 'authentication_failed', esc_html__( 'Login disabled.', 'wpse' ) );
} );

so that you will get a notice about that after trying to login:

enter image description here

But it will be better if users don't have to login in the first place to get the message. We can add a message like:

add_filter( 'login_message', function( $message ) {
     return sprintf ( 
         '<p class="message">%s</p>', 
         esc_html__( '👉 Login is disabled! 🛑 ⛔', 'wpse' ) 
     ) . $message;
} );

That will show up as:

enter image description here

... or maybe it's better to just hide the form in the first place with e.g.:

add_action( 'login_enqueue_scripts', function() {
    wp_add_inline_style( 
        'login', 
        ' body.login #loginform, 
          body.login #nav,
          body.login .language-switcher {
             display:none;
          }' 
    );
} );

in addition to the above steps.

That will give us:

enter image description here

We note that to remove the sessions for the current user there's the wp_destroy_all_sessions() function if needed.

0

Wow - lots of great solutions offered....silly me, I just remove the wp-login.php file from the server, and - if as Tom Nowell asks - any currently logged-in users need to be booted out, I change the salt keys in wp-config.php.

If you want to be more polite, you could swap the wp-login.php file for one that has just a nice message instead of the login form.

No coding necessary, although this is definitely the lazier solution!

2
  • ps: there is a way for users to gain access to WordPress CRUD even if wp-login.php file is missing, i.e. through the XML-RPC API.
    – birgire
    May 31 at 22:58
  • Yes indeed you are correct, but since I don't use the REST API, I have XML-RPC shut down as well. You can either use a plugin to do that, or you can simply remove that file (xmlrpc.php) from the server also, which is what I do. Mine is admittedly a lazy solution but my users' needs are very simple so I have the luxury of a simple solution.
    – Trisha
    Jun 2 at 8:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.