• Hello,

    In the iThemes security plugin I have enabled hide backend, which is supposed to hide the wp-login in favor of what I have chosen, but I found the login in the HTML source of my site, from a simple manual scan.

    ——-
    <span id=”site-admin-link”> Log in</span>
    </div><!– #site-info –>
    ——-

    (link has been edited)
    Correct me if I’m wrong, but this does not seem terribly secure.
    Is there a way to fix this, because it is a clear oversight.

    Thanks.
    – Joe

    https://wordpress.org/plugins/better-wp-security/

Viewing 4 replies - 1 through 4 (of 4 total)
  • Thread Starter josephare

    (@josephare)

    Sorry, this (where xxxxx is the login name):

    <span id=”site-admin-link”>
    Log in</span>
    </div> <!–#site-info –>

    the link: <!– rel=”nofollow” href=”http://www.otlmm.com/xxxxx&#8221; –>

    And because you posted it on this forum now the entire world knows …

    The iTSec plugin “Hide Backend” feature is primarily for preventing AUTOMATED brute force attacks on your default (backend) WP Dashboard login page (wp-admin or wp-login.php).

    It does not completely hide your login url from the frontend …

    Also the hidden html span element with id “site-admin-link” is styled using the following cascading stylesheet:

    http://www.otlmm.com/wp-content/themes/tiny-forge-childs/style.css

    So go and talk to your theme developer … and leave us in peace.

    dwinden

    Thread Starter josephare

    (@josephare)

    The entire world knows, because I put xxx in the link?

    Sure I’ll leave you in peace, because I’ll choose NOT to use this product.

    Thanks

    No Joe, because you exposed your website url … and obviously you haven’t got a clue …
    Anyone visiting that url and then checking the site html source just like you explained in your post will be able to find your “secret” login slug … I did, so anyone can …

    Whether you choose to use the iTSec plugin or not makes ab-so-lu-te-ly no difference to me … (Well actually perhaps its better this way).

    Run along and find yourself a free security plugin for dummies …
    or be prepared to learn something from posts from people like me … and talk to your theme developer …

    Oh don’t forget to mark the topic as ‘resolved’ on your way out …

    dwinden

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘iThemes Security – Hidden Login Not Hidden’ is closed to new replies.