4

The primary goal is to hide that the site is driven by wordpress. I've got the login part all locked up, but the logout URL still has those blasted wp delineators that give away it's a wordpress site.

Is there a way to somehow mask this URL? Perhaps by a conjunction of custom redirect where the client-side link goes to www.site.com/logout/ but something in functions.php rebuilds the actual logout link?

I've tried variations of wp_logout_url('$index.php') but this only redirects. I've also tried

add_filter( 'wp_logout_url', 'cusotm_logout' );
function cusotm_logout() 
{
    // set your URL here
    return 'http://www.site.com/logout/';
}

Not only does this last one not work, it also appends title= to the end of the URL. I'm not sure if the logout doesn't work because of that or if the function itself is the wrong approach entirely.

I only use plugins if I absolutely have to. Looking for a self-managed solution... without needing to mod_rewrite if at all possible.

1 Answer 1

5

Replacing just the URL is not enough. You have to tell WordPress what to do with the new URL.

Sample code, creates a log-out URL like example.com/logout=1 and redirects to front page or custom URL after logging the user out:

add_filter( 'logout_url', 't5_custom_logout_url', 10, 2 );
add_action( 'wp_loaded', 't5_custom_logout_action' );

/**
 * Replace default log-out URL.
 *
 * @wp-hook logout_url
 * @param   string $logout_url
 * @param   string $redirect
 * @return  string
 */
function t5_custom_logout_url( $logout_url, $redirect )
{
    $url = add_query_arg( 'logout', 1, home_url( '/' ) );

    if ( ! empty ( $redirect ) )
        $url = add_query_arg( 'redirect', $redirect, $url );

    return $url;
}

/**
 * Log the user out.
 *
 * @wp-hook wp_loaded
 * @return  void
 */
function t5_custom_logout_action()
{
    if ( ! isset ( $_GET['logout'] ) )
        return;

    wp_logout();

    $loc = isset ( $_GET['redirect'] ) ? $_GET['redirect'] : home_url( '/' );
    wp_redirect( $loc );
    exit;
}

As plugin on GitHub, because this is pure plugin territory. And you cannot really hide WordPress.


it also appends title= to the end of the URL

I guess the problem is markup like this:

<a href="<?php echo wp_logout_url(); ?> title="Log out">Log out</a>

Note the missing ".

6
  • Fantastic, thank you! I realize you can never hide wordpress completely, but there are certainly simple things you can do to make it less obvious for security reasons. I have a client who has recently been repeatedly hacked by bots, so I have been digging deeper into security precautions and anonymizing wordpress as much as possible. Dec 14, 2012 at 22:14
  • I notice, though, that it still appends title= to the end of the URL. The logout function works, but do you know why it's appending it or if it can be removed? Dec 14, 2012 at 22:15
  • This can only happen if you forgot a closing " or ' in your markup somewhere.
    – fuxia
    Dec 14, 2012 at 22:23
  • In login.php or functions.php? I don't see any on either page, but will look harder. Dec 14, 2012 at 22:25
  • 1
    @KristinaChilds See my update.
    – fuxia
    Dec 14, 2012 at 22:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.