Secret URL, disable lost password & more…

Alright, after searching for many hours I found out that Cerber actually overrides the functionality of wp-login.php

So, after deactivating Cerber and getting back my regular wp-login.php page, I played around and saw I could disable both registration and forgot password functionalities by adding the following code in my functions.php:

For disabling registration:

 add_filter('option_users_can_register', function($value) {
    $script = basename(parse_url($_SERVER['SCRIPT_NAME'], PHP_URL_PATH));
 
    if ($script == 'wp-login.php') {
        $value = false;
    }
 
    return $value;
}); 

For disabling Password Reset:

 function disable_lost_password() {
    if (isset( $_GET['action'] )){
        if ( in_array( $_GET['action'], array('lostpassword', 'retrievepassword') ) ) {
            wp_redirect( wp_login_url(), 301 );
            exit;
        }
    }
}
add_action( "login_init", "disable_lost_password" ); 

However, when I turn Cerber back on and set a custom URL (I have set “site-login”) to overwrite wp-login.php, both register and forgot password continue to function.

So, can you please show me the tweak I need to add/modify to the functions above, so the desired effect can work on my “site-login” URL too?

Thank you.

Also just to let you know that the “Disable wp-login.php” function is not working and that page is accessible.

I tried it on a clean localhost also.

Hey, what did exactly the new version fix?

The wp-login.php is still accessible and not returning a 404.

Hmm, I think the answer was here all along:

https://wordpress.org/support/topic/disable-wp-loginphp-does-not-working/