Custom Code to Hide and Secure Your WordPress Login Page

Why Use Custom Code Instead of a Plugin?

While plugins provide easy-to-use solutions, they often come with vulnerabilities, conflicts with other plugins, or slow performance due to unnecessary features. With custom code, you can create a more lightweight, secure, and tailored solution that fits your exact needs without the overhead or potential security risks associated with plugins. Custom code is also more maintainable in the long run, and you don’t have to worry about compatibility issues during plugin updates.

Pros and Cons of Using Custom Code to Hide Your Login Page

Pros:

No need for additional plugins, reducing the risk of conflicts.
More control over the security of your login page.
Lightweight and faster performance since no extra plugin resources are loaded.
Customizable — easily tweak the code to meet your site’s unique needs.

Cons:

Requires a bit more technical knowledge to implement and maintain.
You’ll need to manually update the code when changes are necessary.
If you make a mistake in the code, it could break your login page or site.

Installing the Code

This approach uses a custom PHP hook to hide and secure your WordPress login page. For instructions on how to add hooks to your WordPress site, please refer to my previous tutorial: How to Add PHP Hooks in Your WordPress Site.

Once you understand how to add a hook, you can copy the following code into your theme’s functions.php file or a custom plugin:

<?php

class Pexlechris_Custom_Login_Page {

    private $custom_login_slug = 'custom_slug_to_allow_admin_login';
    private $cookie_name = 'pexlechris_custom_login';
    private $cookie_value = 'allowed';
    private $cookie_expiration = 30 * DAY_IN_SECONDS; // 30 days by default

    public function __construct() {
        add_action('init', [$this, 'maybe_set_cookie']);
        add_action('init', [$this, 'restrict_login_page']);

        // Hook that blocks admin login unless they came through your custom login page:
        add_filter( 'wp_authenticate_user', [$this, 'not_allow_admins_to_login_from_frontend_login_form']);
    }

    public function not_allow_admins_to_login_from_frontend_login_form($user)
    {
        if ( is_wp_error( $user ) ) {
            return $user;
        }

        // Only apply for administrators
        if ( ! user_can( $user, 'administrator' ) ) {
            return $user;
        }

        // Check if cookie exists (from custom login page)
        $has_cookie = $_COOKIE[ $this->cookie_name ] ?? '';

        if ( $has_cookie === $this->cookie_value ) {
            return $user; // allow login
        }

        // Deny login with error message
        return new WP_Error( 'restricted_admin_login', __( 'Admin login is not allowed from this page.', 'textdomain' ) );
    }

    public function maybe_set_cookie() {
        if ( ! $this->is_current_url_custom_login_page() ) {
            return;
        }

        setcookie(
            $this->cookie_name,
            $this->cookie_value,
            time() + $this->cookie_expiration,
            COOKIEPATH,
            COOKIE_DOMAIN,
            is_ssl(), // secure only if SSL
            true // HTTP only
        );

        $url = is_user_logged_in()
            ? admin_url()
            : wp_login_url();

        wp_redirect($url);
        exit;
    }

    public function restrict_login_page() {
        if ( $GLOBALS['pagenow'] !== 'wp-login.php' ) {
            return;
        }

        $has_cookie = $_COOKIE[$this->cookie_name] ?? '';

        if ( $has_cookie === $this->cookie_value ) {
            return; // ok
        }

        wp_redirect( site_url('/404/') );
        exit;
    }

    private function is_current_url_custom_login_page() {
        $request_uri = parse_url( $_SERVER['REQUEST_URI'] ?? '', PHP_URL_PATH );
        $request_uri = untrailingslashit( $request_uri );
        $custom_login_slug = untrailingslashit( $this->custom_login_slug );

        return $this->ends_with( $request_uri, $custom_login_slug );
    }

    private function ends_with( $haystack, $needle ) {
        $length = strlen( $needle );
        if ( ! $length ) {
            return true;
        }
        return substr( $haystack, -$length ) === $needle;
    }
}

new Pexlechris_Custom_Login_Page();

Make sure to replace the custom_slug_to_allow_admin_login with your desired custom login URL. This will be the URL where your admins can log in (e.g., https://example.com/custom_slug_to_allow_admin_login).

Cookie Expiration and Customization:

By default, the cookie is set to expire after 30 days, meaning your admin users will be able to log in via your custom login page for the next 30 days without needing to go through the login page again. If you’d like to change the duration for which the cookie is stored, simply adjust the value in the code. For example, to set the cookie to expire after 7 days, change this line:

private $cookie_expiration = 30 * DAY_IN_SECONDS; // Change the value to suit your needs

Change 30 to the desired number of days. You can also set the expiration time to a custom value (e.g., hours or minutes), just make sure to adjust the code appropriately.

Final Notes:

By using this custom code, you’re taking control of your login security. You can prevent brute force attacks and unwanted access to the wp-login.php page while ensuring only authorized users can log in. Be sure to test thoroughly to make sure your login page works as expected.

About Pexle Chris

Related Post