Renames but, there is still a back door.

The pattern matching against most file names is pretty lax in the plugin and WordPress in general, and chances are your rewrite rule does not cover all cases. For example the following also redirects to the login page:

/foo/bar/wp-register.php/foo/bar

These are my rewrite rules now:

RewriteRule ^wp-login\.php\b - [F]
RewriteRule ^login(/.*)?$ - [F]
RewriteRule ^admin(/.*)?$ - [F]
RewriteRule \bwp-register\.php\b - [F]  # URL doesn't have to start with it!
RewriteRule ^wp-signup\.php\b - [F]
RewriteRule ^wp-activate\.php\b - [F]
RewriteRule ^wp-mail\.php\b - [F]
RewriteRule ^xmlrpc\.php\b - [F]

Plus Rename wp-login.php, plus .htaccess directory protection on /wp-admin. Let’s see how it goes…

@ddaum What did you do for .htaccess directory protection?

Me, up until 5 days ago, I only had a handful of single hack attempts after installing Rename wp-login.php. However, during a three day period, I had hundreds of bot hack attempts all from different ip addresses, and about 5 minutes apart. This finally motivated me to install a disable xmlprc plug in. So far so good.

Hey Mr.Yuck, I simply put a .htaccess password protection on /wp-admin, which protects on top of WordPress’ own user management (it’s only me anyways). Looks like this:

AuthName "admin area"
AuthType Basic
AuthUserFile /path/to/my/webspace/.htpasswd
AuthGroupFile /dev/null
require valid-user

For the .htpasswd file, you can just create one online; Google for htpasswd.

How did you measure/track hack attempts?

If you’re in a hurry you can patch the wp-include\canonical.php file.
Search for $redirect_url = site_url( ‘wp-login.php?action=register’ );
and comment out (//) that line.
I know is bad practice to mess with wp files but I hope the plugin’s author comes up with a solution.
Bye.

It will be pretty hard for the plugin developer to come up with a clean solution for this, because the canonical.php is executed even before any plugin hooks are registered, therefore it cannot intercept the site_url() call like it can for login/signup/activate.

That wp-register.php redirection is there for historical reasons only anyway and should be deprecated/removed by WordPress soon (I hope).

If you go ahead and mess around a lot in WP’s or other plugins’s code, (like I do) I recommend putting your whole installation into version control (i.e. Subversion). This makes tracking your changes and merging new versions together really easy. It also helps tracking changes that WP does to itself, like .htaccess changes, styles, auto-updates, etc. – I couldn’t live without it…

ddaum

Thanks for the info, ddaum. I use Aryo Activity Log to see log in attempts, under the log type “user”. You can filter by type of log, and I generally need to, because the overwhelming majority of log entries are the 2,000 or so spam comments per month I receive. ??