wordpress login wp-login.php change url

Question

Few days ago I've noticed that someone is using brut force attack to try to log in into our Wordpress page.

This is what I did:

1. changed the name of the wp-login.php file and changed all url in the file to new url

2. added a functions to change logout url and redirect to home page after logout

add_filter( 'logout_url', 'custom_logout_url' );


function custom_logout_url( $default ) { 
    return str_replace( 'wp-login', 'newloginpageurl', $default ); 
    }

add_action('wp_logout','auto_redirect_after_logout');

function auto_redirect_after_logout(){
  wp_safe_redirect( home_url() );
  exit;
}

3. added function to redirect everyone who is trying to access to wp-login.php to 404

add_action('init', 'force_404', 1 );

function force_404() {

$requested_uri = $_SERVER["REQUEST_URI"];
do_action('debugger_var_dump', $requested_uri, '$requested_uri', 0, 0);
do_action('debugger_var_dump', strpos( $requested_uri, '/wp-login.php'), 'FOUND?', 0, 0);

if (  strpos( $requested_uri, '/wp-login.php') !== false ) {

    do_action('debugger_var_dump', 'REDIRECT', 'REDIRECT', 0, 0);
    // The redirect codebase
    status_header( 404 );
    nocache_headers();
    get_template_part( 404 ); 
    die();
}

if (  strpos( $requested_uri, '/wp-login.php') !== false || strpos( $requested_uri, '/wp-register.php') !== false ) {

    do_action('debugger_var_dump', 'REDIRECT', 'REDIRECT', 0, 0);
    // The redirect codebase
    status_header( 404 );
    nocache_headers();
    get_template_part( 404 );
    die();
}

do_action('debugger_var_dump', 'END', 'END', 0, 0);

}

Everything was tested and works fine, wp-admin works only when user is login in other case it by default redirect to wp-login as normal Wordpress and after because of function force_404 it's redirecting to 404 page.

I cleared all cache files.

Everything was ok, until one person from the company logged in for the first time after the changes. Apparently to attacks are back now.

Did I do things right and it's connected with that person having some malware or I just did something wrong and it's coincident?

Do you mean the attacker now targets the new (renamed) login script? — Zoli Szabó, Dec 08 '20 at 10:38

Zoli Szabó · Answer 1 · 2020-12-08T12:34:20.613

0

The problem with manually renaming wp-login.php is that you need to repeat it after every WordPress update.

Some other options would be:

Using a security plugin, e.g. Wordfence or WP Cerber Security.
Put Basic Auth on the wp-login file: HTTP Basic Auth Exclude Single File
Restrict login to a list of defined IP addresses.

edited Dec 08 '20 at 12:34

answered Dec 08 '20 at 10:59

Zoli Szabó

4,366
1
13
19

1

I'm aware that update will change the file 1. I don't want to use plugin as they slow down website 2. http-auth is a solution, but I rather to avoid it as some people in my company can find it problematic 3. Restricting IP also can be problematic My goal is to secure wp-login without causing to much trouble to simple users – Patryk Dec 08 '20 at 11:41

wordpress login wp-login.php change url

1 Answers1