外掛說明

Block wp-login.php and use a secret login URL

Block wp-login prevents automated requests from reaching the default WordPress login endpoint. It creates a secret login URL for authorised users and adds Apache rewrite rules that return a 403 Forbidden response for direct requests to wp-login.php.

Because blocked requests are rejected before WordPress loads, the plugin can reduce the server resources consumed by bots repeatedly targeting wp-login.php.

Features include:

Choose your own secret login slug or generate a random one.
Block direct access to the default wp-login.php endpoint with a 403 response.
Continue to support password resets, registration and WordPress administration email verification through the secret login URL.
Rebuild the secret login file after a WordPress core update.
Optionally email administrators when the login URL changes.
Optionally notify the site owner when an administrator signs in from an IP address that is not on the known-IP list.

Important compatibility information

Block wp-login requires an Apache web server with mod_rewrite and a writable .htaccess file in the WordPress root directory. It is not compatible with Nginx or servers that do not honour .htaccess rules.

Hiding the default login endpoint reduces automated login traffic, but it is not a replacement for strong passwords, two-factor authentication, updates, backups or other appropriate security controls.

安裝方式

Before installing, confirm that the site runs on Apache and that WordPress can write to its root directory and .htaccess file.

Install Block wp-login from Plugins > Add New, or upload the plugin ZIP file.
Activate the plugin.
Go to Settings > Block wp-login.
Enter a memorable login slug using letters and numbers, or generate a random one.
Select the administrator notification option if you want the new login URL sent by email.
Save the settings.
Copy and bookmark the displayed login URL.
Keep your current administrator session open while you test the new URL in a private or incognito browser window.

After configuration, direct requests to wp-login.php should return 403 Forbidden. Use the secret URL for login, registration and password-reset requests.

常見問題集

What is wp-login.php?: wp-login.php is the standard WordPress endpoint for login, registration and password-reset requests. Its predictable location is frequently targeted by automated bots.
Does this plugin stop every brute-force attack?: No. It blocks automated traffic aimed at the default wp-login.php address and can reduce the associated server load. If someone discovers the secret login URL, normal WordPress authentication still applies. Use strong unique passwords and other suitable security controls as well.
Does it work with Nginx?: No. Block wp-login relies on Apache mod_rewrite and .htaccess. Do not activate it on Nginx or another server that does not process Apache .htaccess rules.
Can users reset their passwords or register?: Yes. Password-reset emails, reset forms and registration links use the secret login URL. WordPress administration email verification is also supported.
What happens after a WordPress core update?: The plugin detects a changed WordPress version and rebuilds its secret copy of the current wp-login.php file. If the server is overloaded, it safely defers that work until a later administrator request.
What should I do if I forget the secret login URL?: First check the notification email sent when the URL was configured. If you have command-line access, deactivating the plugin with WP-CLI runs its cleanup routine and restores the default login endpoint. Otherwise, ask your hosting provider or developer to remove the section between # BEGIN BlockWPLogin and # END BlockWPLogin from the WordPress .htaccess file before deactivating the plugin. Take a backup before editing .htaccess.
How do I return to the standard WordPress login URL?: Go to Settings > Block wp-login, clear the Private login address field and save the settings, or deactivate the plugin normally. The plugin removes its rewrite rules and generated login file.

使用者評論

STIJL 2023 年 7 月 8 日 1 則留言

After using other “hide login” alternatives with varied crappy results, webd’s Block wp-login actually works well and does what it needs to do without challenging the admin. If you want to hide your login – this is it.

ktk77 2022 年 9 月 6 日 3 則留言

The customized login URL stopped working, leading to a “403 Forbidden” page and locking me out of my site. I had to resolve the situation through my host, after which I got back into my dashboard and deactivated this plugin (which, as of this writing, hasn’t even been updated in 4 months). A highly inconvenient experience following several weeks of relatively smooth performance. User beware.

Jimmy Lee 2022 年 4 月 27 日 1 則留言

After being abandoned and not updated in 5 years, SF Move Login plugin finally started throwing me errors, started a quest to find another login security plugin written as smart or smarter than that little gem … FOUND IT! Really love your approach here, Scientifically Whitty! 5-Stars ALL DAY LONG! Thank you and Best Wishes!

TrishaM 2021 年 1 月 12 日 2 則留言

This plugin does exactly what I need it to do, it hides my login page, and doesn’t carry extra weight or complexity. I added this after I discovered a ton of (unsuccessful) attempts to hack into my site through the login process (in addition to requiring all my users to update their passwords to something much stronger). I realize where there is a will there is a way and I’ll still be at risk if one or more of my *users* gets hacked and their saved login link and credentials get stolen, but I sure sleep better at night now knowing that my site is just a bit safer.

andybull 2018 年 1 月 8 日

Adds a reassuring additional level of security against hackers

f5nn9s3f8 2017 年 4 月 21 日

A valuable tool to combat security issues facing WordPress users.

閱讀全部 9 則使用者評論

參與者及開發者

以下人員參與了開源軟體〈Block wp-login〉的開發相關工作。

Oliver Campion

〈Block wp-login〉外掛目前已有 2 個本地化語言版本。感謝全部譯者為這個外掛做出的貢獻。

將〈Block wp-login〉外掛本地化為台灣繁體中文版

對開發相關資訊感興趣？

任何人均可瀏覽程式碼、查看 SVN 存放庫，或透過 RSS 訂閱開發記錄。

變更記錄

1.5.8

Moved configuration to a dedicated settings page without triggering permalink refreshes.
Added activation and save checks for rewrite support and required filesystem permissions.
Added filesystem locking and persistent version state to prevent duplicate core-update reinstalls and reminder emails.
Improved settings guidance and Deny All Firewall integration.

1.5.7

Added support for the forthcoming Deny All Firewall 2.0 rules-refresh action.
Added an administrator notice when the Deny All Firewall 2.0 update is available.
Deferred core-update reinstalls while the server is overloaded.
Hardened filesystem operations and prevented reminder emails before a successful reinstall.

1.5.6

Fix a minor issue highlighted by “Plugin Check” code review and preparing for WordPress v7.0

1.5.5

Fix a minor bug and general housekeeping preparing for “Plugin Check” code review

1.5.4

Updated race condition prevention when WordPress core version changes

1.5.3

I18N issues resolved thanks to Alex Lion @alexclassroom and added a transient check to prevent a race condition when WordPress core is updated

1.5.2

General housekeeping

1.5.1

Added an option to email the site admin if an administrator signs in with an un-recognised IP address
Added translation strings

1.5

General housekeeping

1.4.9

Fixed bug that causes an error if the login_url hook is fired early

1.4.8

Preparing for WordPress v6.0

1.4.7

Fixed a cookie related bug with Google Chrome preventing login

1.4.6

Fixed bugs when .htaccess cannot be opened
Removed all PHP short tags

1.4.5

Preparing for WordPress v5.8

1.4.4

General housekeeping

1.4.3

General housekeeping

1.4.2

Added an option to send login URL reminders when saving Permalink settings

1.4.1

Added random login generator.

1.4.0

Premium functionality is now free!

1.3.9

Bug fix

1.3.8

Removed functionality now dealt with by Deny All Firewall

1.3.7

Yet more fixes for compatibility with WordPress 5.3

1.3.6

Further fixes for compatibility with WordPress 5.3

1.3.5

Fixed a bug that blocked Admin Email Verification in WordPress 5.3

1.3.4

Integrated plugin with new Deny All Firewall plugin

1.3.3

Plugin now allows password protected posts and pages to work

1.3.2

Important security update

1.3.1

Important security update

1.3.0

Automated upgrade activation facility
Bug fixes

1.2.4

Bug fix

1.2.3

Updating new developer / activation domain
Updating tested version

1.2.2

Bug fixes.

1.2.1

WordPress upgrade email re-worded

1.2.0

Plugin now automatically detects when WordPress has been upgraded and re-installs itself.
Bug fixed for when wp_mail() isn’t working

1.1.7

Bug fixes.

1.1.6

Plugin now upgrades automatically when activated if licensed.

1.1.5

Plugin is now internationalised ready for translation.
Help banner admin notice now appears until plugin has been configured.
Added help links on the settings page and added this information to the FAQ.
Minor bug fixes.

1.1.4

Blocking admin-ajax.php now allows commands when inniated from /wp-admin/.
Blank user or site owner emails won’t break saving settings.
Duplicate emails are not sent now when site owner and user email addresses are the same.
Options to block admin-ajax.php, wp-cron.php, xmlrpc.php and robots.txt are disabled until wp-login.php block is activated.

1.1.3

Plugin now emails all Administrators and the email set in General Settings with the new login URL.

1.1.2

Added option to block admin-ajax.php, wp-cron.php, xmlrpc.php and robots.txt for the free plugin.

1.1.1

Bug fixes.
Option to block wp-cron.php, admin-ajax.php and robots.txt for upgraded plugin.

1.1.0

Plugin re-written to make use of “Settings – Permalinks” so upgraded plugin can choose custom login slug.
Plugin now reverses changes when deactivated.
Plugin creates random login slug.

1.0.0

First, beta version of the plugin.

Best of Breed

Turned against me after 2 months

Found It!

Lightweight and superb

Great protection against hackers

A valuable tool