• Resolved sporkme

    (@sporkme)


    Hi,

    WP 5.5 and the latest (1.8.6) plugin installed.

    We noticed on update to 1.8.6 that many more spam registrations were coming through. On checking the settings, I saw we did still have “Enable Prevent Core Login” checked, which claims to disable the standard WP endpoints for login/registration/etc.

    But even with that set, if I go directly to /wp-login.php?action=register and enter my info, I can create an account. That used to be blocked by the “Prevent Core Login” setting… Any hints here as to what’s causing this?

Viewing 5 replies - 1 through 5 (of 5 total)
  • Hi @sporkme,

    Can you please whether you have selected the correct account page here: https://prnt.sc/u8rhof and here: https://prnt.sc/u8riju

    Please make sure that these two places must have the same account page. If you have already selected those account pages and still getting directly to the link then please let me know and I will get back to you accordingly.

    Regards!

    Thread Starter sporkme

    (@sporkme)

    Hi Deepak,

    Yep, I verified they are both set. I re-saved, just to be sure, and then tested and wp-login.php was still accessible.

    Temporarily, I’m doing this, but it causes issues with password-protected pages:

    // User Reg plugin is supposed to block core/native login, but is not as of 1.8.6
    add_action('init','custom_login');
    
    function custom_login(){
    	global $pagenow;
    	if( 'wp-login.php' == $pagenow && $_GET['action']!="logout") {
    		wp_redirect('https://example.com/');
    		exit();
    	}
    }

    Thanks,

    Charles

    Thread Starter sporkme

    (@sporkme)

    Any ideas? I can probably work up a test case for you on some staging instance somewhere. It’s easy to test, enable the feature, then navigate to /wp-login.php and see if you get redirected or not…

    Hi @sporkme,

    I have confirmed it by testing it in our environment that it works fine. However, it’s strange to hear that it’s not working for you even after the setup is correct.

    I think your case would need our developer’s attention so I would like to request you to contact our developer team here: https://www.wpeverest.com/contact/ and someone from the team will get back to you.
    Also, make sure that you attach the link of this ticket in the message so that they can get an overall idea of what the issue is.

    Regards!

    Thread Starter sporkme

    (@sporkme)

    Thanks! I’ve submitted this issue.

    Also, your https config is a bit off – your cert covers “wpeverest.com” but NOT “www.wpeverest.com”, generating a security error/warning.

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘“Enable Prevent Core Login” not working’ is closed to new replies.