renamed wp-login.php
-
Getting a lot of login attempts on a particular site today that really isn’t used much so I renamed wp-login.php to a random string.php but I’m still getting user locked out from signing in emails.
I know I can change the settings to stop the emails but my curiosity has me. If wp-login.php is effectively missing shouldn’t they just be getting 404 when trying to login?
-
Apologies for not reading the origin of this thread as carefully as I should have. Been so used to “hide wp-login.php” type posts I tend to fire off too fast. In my case, I do not use or need xmlrpc in fact I hate it for the time it takes to deal with. So I delete xmlprpc.php and place /xmlrpc.php in the Wordfence “Options/Immediately Block URLs.” I used to just block xmlrpc.php in my .htaccess file, but I’d rather use it as a honey pot that results in lengthy IP blocks implemented by Wordfence. In my case I set those blocks to 48 hours.
As for wp-login.php, sure, delete if not needed (I use WPS Hide Login plugin as we do need the login for our sites). I’m a big fan of deleting as many WordPress core files as possible as who knows what attack vectors will be discovered tomorrow (oh joy). For example, I delete wp-mail.php and wp-signup.php. One has to delete these sorts of things each time WordPress updates. I suppose one could set up a cron job to do this, but I’m in the site root enough anyway so I just do it manually.
A cool Wordfence feature, actually, would be a programatic audit of WordPress core that suggested core file elimination via checkboxes. Oh blasphemy!
MTN
- The topic ‘renamed wp-login.php’ is closed to new replies.
