The problem with having a “hook” is that the add_action() function would not be defined that early so WordPress would have to be recoded so that the function is available much earlier.
Also to use an action hook you would need to add your code inside a theme or a plugin. WordPress must make database requests in order to load themes and plugins. So the code that hooks into this action would have to be added inside an MU plugin and again WordPress would need to be re-coded so that MU plugins load earlier.
I highly doubt WordPress would ever update to support this.
Bots, Brute Force attacks, DDoS…etc. This should all be managed server-side via your website’s firewall. Not via PHP.
Related Posts:
- What is the difference between a cer, pvk, and pfx file?
- How to solve “Kernel panic – not syncing – Attempted to kill init” — without erasing any user data
- What’s the best approach for generating a new API key?
- Is it possible to decrypt SHA1
- How does the SQL injection from the “Bobby Tables” XKCD comic work?
- Error `sec_error_revoked_certificate` when viewed in Firefox only
- Convert .pfx to .cer
- Why should I use the esc_url?
- Where to securely store API keys and passwords in WordPress?
- Why escape if the_content isnt?
- Full path disclosure on rss-functions.php
- What to use instead of wp_kses() in user output
- Are the default salts secure?
- is_email() VS sanitize_email()
- Subscribe to email for security fixes?
- How to escape custom css?
- Understanding SVG vulnerabilities in WordPress related to a specific fix
- Moving wp-config.php: Can this be done after site launch?
- How to secure or disable the RSS feeds?
- What are the pros and cons of using a custom front-end to retrieve content from a WordPress back-end
- Make password invalid once logged out of password-protected page
- How to get WordPress to save upload file beyond web root [closed]
- Is security a problem in WordPress?
- Moving wordpress out of the public directory
- Logout via Subdomain, non-wordpress page on a different server?
- Protecting HTML5 video [closed]
- How can I tell who changed the password?
- WordPress website Security [closed]
- Do I need to use the esc_html() function on hard coded links?
- Can’t reset WordPress password
- Is the “lost password” feature truly a vulnerability?
- Frontend Password change
- Is it possible to reduce the minimum character length for passwords?
- Handling email piping attachments and detecting unsupported file types
- Downloading File from Outside Web Root
- site get login attempts after htaccess ip restriction
- Is it good security advice to install wordpress in subdirectory but link to root?
- Why was my blog post inserted lot’s of ad links by others?
- Moving wp-config.php up 2 levels
- How Could I sanitize the receive data from this code
- WordPress SQL Injections through User Agent
- Should I Worry About SQL Injection When Using wp_insert_post?
- Is there a way for a user to have an alias?
- How to prevent wp-login brute force attack from thousand of different IP? [duplicate]
- What permissions should I give directories if I want to make WordPress more secure?
- Security threat with `home_url`?
- When is wp_set_password() called or how to capture a password
- How to protect wp-admin through .htaccess?
- Something is unescaping all html entities before output to browser [closed]
- Frequently getting attacks on admin-ajax.php, wp-cron.php, xmlrpc.php and wp-login.php
- How to get WordPress to send Password Reset Link Email instead of New Password?
- Is wp_kses the right approach in sanitizing this string?
- Verifying that I have fully removed a WordPress hack?
- Large Session Tokens
- How to change permissions of WordPress and/or apache on macOS securely?
- Using an Encryption class in a WordPress Plugin
- Limit Login Attempts BEFORE PHP is executed?
- Safe to say WordPress security releases don’t have database upgrades
- Config file with no Keys..?
- How much should I worry about these messages?
- Security concerns with external links
- Use global variables or function that returns said variables for site-wide private-ish WP settings?
- Uploading .webm format on WordPress results in security guidline breach and fail
- fail2ban to prevent Brute Force Attacks on WordPress?
- .htaccess password protection bypassed
- Session Cookie security questions
- How to give the same error message when the wrong password or wrong username is used?
- Storing FTP details in wp-config.php
- Spam injected in w3 total cache page cache [closed]
- How to distinguish between a hack and an encoding error?
- Prevent editor from adding script or form
- How to change location of wp-config.php to folder or 2 folders up?
- How might I sanitize an XML file before WP Import? (Does wordpress verify or clean text when importing from an XML document? )
- Finding where a snippet of code is coming from
- Remove hacked code – out of ideas! [closed]
- Secret keys in SCM
- Secure Server after configuration
- After limiting the access to my wp-login.php by IP through .htaccess, all my password-protected posts stopped working. What’s the best solution now?
- Block JSON access over the net
- Can someone do something to my website if I posted a snapped image of the header and covered my logo? (On reddit, when explaining a question)
- Scan multiple websites for malware that are in same webhost root?
- The in-famous Unable to locate WordPress Content directory (wp-content) and the Direct Method
- Security: Critical backend outside of wordpress
- Advice On How to Backup WordPress
- How to check whether a site has been compromised without browsing into it?
- My site thinks it’s secure when it is fact not
- Is it possible to only have the admin interface bind to the local loopback?
- PHP Code Sniffer – WordPress VIP Coding Standards
- Should I change the default file and folder permissions?
- WordPress exploited theme is causing high io load on server
- How to rewrite rules for WP-security in Nginx?
- How to set custom validation for WordPress Passwords?
- Is it a bad idea to CHMOD 777 all the files on your site?
- How to stop repeated hack on header.php of custom theme? [closed]
- Default installation permissions for wp-config.php
- Correct setup to block file modifications from hackers
- Possible to change email address in keypair?
- SSH keypair generation: RSA or DSA?
- Why is SSH password authentication a security risk?
- Successful password resets and suspicious scripts on my WordPress instance