pmgllc/stealth-login-page

Protect your /wp-admin and wp-login.php pages from being accessed without editing .htaccess

stealth-login-page's Issues

Bots don't respect 302 redirects. Add a file include option.

I have done some extensive research on this.
https://github.com/msigley/PHP-HTTP-Tarpit

Implement one of those defenses is much better than a 302.

Adding HTTP_REFFERER

Using Pippin's HTTP_REFFERER code in the display-functions.php file to immediately kill any attempt from an external URL and elseif if it was an internal request.

Incorrect tabindex on authorization code field

There is no tabindex defined on the authorization code input on the login page. It should be set to 30.

Pull request to fix this will shortly follow.

Improve direct file access blocking

Currently the direct file access blocking is

// Exit if accessed directly
if ( ! defined( 'ABSPATH' ) ) exit;

We can improve it by sending valid HTTP headers by

// Prevent direct access
defined( 'WPINC' ) || header( 'HTTP/1.1 403' ) & exit;

Props @jonathandavis from the Shopp project for this awesome piece of PHP code.

Display new login URL on settings page

To avoid people getting locked out of their dashboards, display their new login URL.

check for empty fields

User activated with only 2 fields filled in and couldn't access the dashboard. Needs to check the 3 fields and not allow enable if not all fields filled in.

E-mail new login URL to site admin

To avoid people getting locked out of their dashboards, e-mail the new login URL to the site admin on the main settings page.