4 comments

  1. If you’re only concerned about login links displayed on your pages, you should be able to modify the URL by hooking the login_url filter. This won’t redirect a user that types http://MYSITE/wp-login.php directly into their browser, but it should affect the login links displayed throughout your site.

    This is the example code from the login_url Codex page:

    add_filter( 'login_url', 'my_login_page', 10, 2 );
function my_login_page( $login_url, $redirect ) {
  return home_url( '/my-login-page/?redirect_to=' . $redirect );
}

  2. 1. Modify your .htaccess file – add this line after index.php rewrite rule:

    RewriteRule ^index.php$ – [L]<br />
RewriteRule ^yoursecretpath$ wp-login.php [L,NC,QSA]

    where yoursecretpath is your path to admin panel.

    2. Modify login_header function in wp-login.php file – add this code just before line 59 (where HTML doc type tag starts, so to prevent headers sending error):

    <?php $uri = $_SERVER['REQUEST_URI']; if(stripos($uri, ‘wp-login’) or stripos($uri, ‘wp-admin’) && !stripos($GLOBALS["HTTP_COOKIE"], ‘wordpress_logged_in’)) {  header("Location: ".get_site_url().'/yoursecretpath' ); exit(); } ?>

  3. I actually already have an open source plugin that does this already:

    https://github.com/tripflex/wp-login-flow

    It was created to require users to verify their emails but you can disable that feature and just use the rewrite feature which is functional in the latest version on WordPress repo (1.0.0).

    You can look at the code to see how I handle the rewrites:

    https://github.com/tripflex/wp-login-flow/blob/master/classes/rewrite.php#L312

    I’m actually working on this now to have some major updates and patches, but for now 1.0.0 works perfectly fine for rewrites. Enjoy 🙂

  4. If you will create a custom login page on your address /login, then create a rewrite:

    function restrict_admin() {

    if ( ! current_user_can( 'manage_options' ) && '/wp-admin/admin-ajax.php' != $_SERVER['PHP_SELF'] ) {
                wp_redirect( site_url() );
    }
}
add_action( 'admin_init', 'restrict_admin', 1 );

    This code will check if the user is an administrator and if they are not WordPress will redirect them back to the website home page.

    Create also a side template for your custom login and use the login defaults of WordPress inside the template:

    $args = array( 'redirect' => site_url( $_SERVER['REQUEST_URI'] ) );
wp_login_form( $args );

    You can also change the redirect adress for the login page. But is also useful, that you check on login errors and maybe you add code for right redirect after failed login. For this jobs use the hook wp_login_failed and authenticate.

Comments are closed.