using rewrites to secure login page

Question

I'm trying to be sneaky with iis to secure a wordpress login page (not my choice to run a windows server, but that's the reality of things). It's worked so far, only the login page itself loads itself before forwarding you to the admin panel so after a successful (or unsuccessful) login the first rule kicks in and sends you to the dummy page. My rules so far:

<rule name="redirect" patternSyntax="ECMAScript">
    <match url="^installbase/wp-login\.php" />
    <action type="Rewrite" url="installbase/index.php?page=403-forbidden" />
</rule>

<rule name="login" patternSyntax="ECMAScript">
    <match url="^sneakyURLforLoggingIn" />
    <action type="Rewrite" url="installbase/wp-login.php" />
</rule>

1: I'm sure there's a more efficient way to do this

2: once wordpress accepts the login it sends you to the 403 page, requiring the user to then manually navigate to /wp-admin/. That's less than ideal.

Any thougths on how to solve this catch-22? Or is there a better way to accomplish the same thing?

Answer 1

You can instruct IIS to provide to wp-login a redirect_to parameter towards wp-admin/; this will do the trick:

<rule name="login" patternSyntax="ECMAScript">
     <match url="^loginUrl/?" />
     <action type="Rewrite" url="wp-login.php?redirect_to={UrlEncode:http://{HTTP_HOST}/wp-admin/}" />
</rule>

By the way, thanks for posting this question, it's helping me to understand better the working of redirects and rewrites in IIS. I found this reference useful: String functions in IIS Rewrite Module