Hello,
It sounds like you may not be using an Apache web server which is required for this plugin as it makes use of the .htaccess file to block the default login.
Activating the plugin and configuring a private login address will automatically produce the following (or similar) when /wp-admin/ or /wp-login.php are accessed …
Forbidden
You don’t have permission to access this resource.Apache/2.4.58 (Ubuntu) Server at webd.uk Port 443
Please check with your hosting provider as to which web server you have.
Oliver
I don’t think it is the hosting. It was working and then it stopped working… I don’t know why it stopped working. I haven’t added extra plugins.
Please makes sure you have a full backup of your site before hand but …
In that case, we would recommend going to the settings (make sure you have the latest version of the plugin installed) in “Dashboard – Settings – Block wp-login” then empty the “Private login address” text field and press “Save Changes”. This will clear any residual settings from your .htaccess file. Then put your “secret login “Private login address” back in the text field and press “Save Changes” again which will make sure the right lines are put into your .htaccess file.
Give that a go and let me know if that helps.
no, it still didn’t help.
This is in my .htaccess file
BEGIN BlockWPLogin
RewriteEngine On RewriteCond %{QUERY_STRING} “^action=postpass$” RewriteRule “^wp-login.php$” /gslogin-wp-login.php [QSA,L] RewriteRule “^wp-login.php” – [F] RewriteRule “^gslogin\/?$” /gslogin-wp-login.php [R=301,QSA,L] END BlockWPLogin
Thanks. The rules shown are the ones the plugin would normally add, although the forum has changed their formatting.
One clarification: Block wp-login does not directly forbid the /wp-admin/ directory. A logged-in administrator must still be able to use it. When logged out, WordPress redirects /wp-admin/ to wp-login.php, and it is that login request which the plugin blocks.
Please open a new private/incognito browser window where you are definitely not signed in, then test the exact addresses:
https://example.com/wp-login.php
https://example.com/wp-admin/
Please let us know exactly what happens at each address, including the final address shown in the browser. If wp-login.phpdisplays the normal login form rather than a 403 response, the rules are present but are not being applied to that request. In that case, please ask your hosting provider to confirm that this particular .htaccess file is active and that AllowOverride/rewrite processing has not recently changed.
It would also help if you could paste the BlockWPLogin section in a code block so that its original line breaks and characters are preserved.
Thank you.
I contacted the hosting, the issue was my site is a subfolder so the path was incorrect. I had pasted in previously the code for the main site, but the site I was trying to block was in a subfolder. This is the code
BEGIN BlockWPLogin
RewriteEngine On RewriteCond %{QUERY_STRING} “^action=postpass$” RewriteRule “^apply/wp-login.php$” /apply/gslogin-wp-login.php [QSA,L] RewriteRule “^apply/wp-login.php” – [F] RewriteRule “^gslogin\/?$” /apply/gslogin-wp-login.php [R=301,QSA,L] END BlockWPLogin
It wasn’t working b/c or /apply in the URL.
Thanks, it works now.
OK, that changes things. Looks like there’s an edge case here that caused your issue and we’ve just published a fix to resolve it. I’m amazed that this hasn’t come up before but … your subfolder installation caused the plugin to use incorrect .htaccess paths that our settings saves failed to detect, so we corrected subfolder path handling and added proper failure reporting and recovery.
We’ve pushed the update (v1.5.9) and hopefully this will be publicly available in 6 hours when the changes have been reviewed by WordPress.
Thanks again for bringing this to our attention.
Oliver
Marking this as “resolved” now.
