For security reasons, it should be possible to rename login.php to something different, and change other access shortcuts (eg: wp-admin) to point to the new URL.
Is there a documented best practice for this? If not, what would the most correct methodology be?
I appreciate that this is not security per se, just obfuscation, but I’m considering this to be just another layer of protection: not a replacement of other security tactics such as failed attempt lockdown limiting and stricted password enforcement.
Creative approaches welcome.
Well, considering rewrite and redirect like in comments –
choose what fits you best .
HOOK wp_login_url();
//this function generate the login url address
Example:
Redirect action
.htaccess rewrite URL
.htaccess redirect rule
Personally I prefer the rewrite function
add_rewrite_rule()
NOTE : some of those methods can change according to wp version, but in the latest versions all should work.
THere are also other methods, if you find none of those suitable for you ..
The challenge of course is not “breaking” or “hacking” core to do this.
Riffing off of krembo99’s filter idea, I wonder whether the following wouldn’t be a high-level approach to the solution from a plugin perspective:
'login_url'
filter to point to this new file'admin_url'
filter to point to a new “pseudo-url” for admin'login_init'
action to either just exit, or put up some default error screen, maybe redirect to the 404 page.do_action( 'login_init' )
line (or replace it with a custom action of your own).I haven’t tested this – it’s just a theory. The biggest challenge left is – when you upgrade WP – does it delete any files that it doesn’t expect in the root? If so, the plugin will also have to check to see if WP has been upgraded and if so, re-install the alternative login file. And of course, we’d want it to be done by copying the newly-upgraded wp-login.php, so it would have to run a regexp search-and-replace on the
do_action( 'login_init' )
line.