How to shutdown wordpress login temporarily

Question

How can I disable wordpress login temporarily even for administrator users? is there any solution?

Answer 1

You could hook into the wp_authenticate_user filter and return an error.

Something like:

add_filter( 'wp_authenticate_user', 'wpse_406123_stop_login', -1 );

function wpse_406123_stop_login() {
    $message = new WP_Error( 'login_disabled', __( '<strong>ERROR</strong>: You cannot login at this time' ) );
    return $message;
}

You can then change your security keys -the ones that look like this to something different - that will invalidate all current logins.

Answer 2

Here's a way to halt the login by returning an error through the wp_authenticate_user filter:

add_filter( 'wp_authenticate_user', function() {
    return new WP_Error( 'authentication_failed', esc_html__( 'Login disabled.', 'wpse' ) );
} );

so that you will get a notice about that after trying to login:

But it will be better if users don't have to login in the first place to get the message. We can add a message like:

add_filter( 'login_message', function( $message ) {
     return sprintf ( 
         '<p class="message">%s</p>', 
         esc_html__( '👉 Login is disabled! 🛑 ⛔', 'wpse' ) 
     ) . $message;
} );

That will show up as:

... or maybe it's better to just hide the form in the first place with e.g.:

add_action( 'login_enqueue_scripts', function() {
    wp_add_inline_style( 
        'login', 
        ' body.login #loginform, 
          body.login #nav,
          body.login .language-switcher {
             display:none;
          }' 
    );
} );

in addition to the above steps.

That will give us:

We note that to remove the sessions for the current user there's the wp_destroy_all_sessions() function if needed.

Answer 3

Wow - lots of great solutions offered....silly me, I just remove the wp-login.php file from the server, and - if as Tom Nowell asks - any currently logged-in users need to be booted out, I change the salt keys in wp-config.php.

If you want to be more polite, you could swap the wp-login.php file for one that has just a nice message instead of the login form.

No coding necessary, although this is definitely the lazier solution!