I believe init is too early to determine is_page(). Try a later hook, like template_redirect. function wpse_344136_user_logged_in(){ if ( is_user_logged_in() && is_page( ‘login’ ) ){ wp_redirect( home_url() ); exit; } } add_action( ‘template_redirect’, ‘wpse_344136_user_logged_in’ );
I’m running a Nodejs/Nginx stack under AWS/ElasticBeanstalk. I was having an issue where I needed my server to log the full path to the request, but all it was logging was requests from the load balancer, (172.31.xx.xx). I had to get AWS support to help debug the issue, and they were able to get the … Read more
This is not core functionality but a “feature” of my security plugin (Wordfence, in this instance). Disabled the plugin by using FTP to rename the folder and was able to log back in.
You can add the static form code to your main site’s code (your domain in this case is example.com and your subdomain is sub.example.com): <form name=”loginform” id=”loginform” action=”https://sub.example.com/wp-login.php” method=”post”> <p> <label for=”user_login”>Username or Email Address</label> <input type=”text” name=”log” id=”user_login” class=”input” value=”” size=”20″ autocapitalize=”off”> </p> <div class=”user-pass-wrap”> <label for=”user_pass”>Password</label> <div class=”wp-pwd”> <input type=”password” name=”pwd” id=”user_pass” class=”input … Read more
The correct answer is to use SSL. However, you could use javascript to encrypt the password somehow before sending it to the server, but this isn’t going to offer much more protection because anyone looking at the data could just as easily unencrypt the password. Here’s more on that: https://stackoverflow.com/questions/12291495/how-to-encrypt-form-data. Use SSL 😉
I have a somewhat similar requirement to you. Currently I am using the below to test for the correct scenario: if ( is_user_logged_in() == true || in_array($GLOBALS[‘pagenow’], array(‘wp-login.php’)) || strpos($_SERVER[‘REQUEST_URI’], ‘wp-admin’) != 0) This doesn’t detect if you have changed the login URLs but you could define Globals or plugin variables to specify ‘wp-login.php’ and … Read more
So I changed this in the wp-config.php file: define( ‘AUTH_KEY’, ‘put your unique phrase here’ ); define( ‘SECURE_AUTH_KEY’, ‘put your unique phrase here’ ); define( ‘LOGGED_IN_KEY’, ‘put your unique phrase here’ ); define( ‘NONCE_KEY’, ‘put your unique phrase here’ ); define( ‘AUTH_SALT’, ‘put your unique phrase here’ ); define( ‘SECURE_AUTH_SALT’, ‘put your unique phrase here’ … Read more
It sounds as though you know your username and password, but if not you can always go into PHPMyAdmin (Or whatever Db tool your server uses) and navigate to the users table. In there you can see your users, and edit your details as required, including your password which you can simply overtype with new … Read more
To prevent brute force attacks, there are some security measures you need to implement on your site Prevent the discovery of usernames Limit login attempts Change the default login page URL Implement two-factor authentication Implement HTTP authentication Use a firewall Implement Geoblocking If you use a username and password that’s long and unique, it will … Read more
Yes, you can add an authenticate filter to handle the email and no password case with a higher priority than the default wp_authenticate_email_password handler. e.g. (untested) function wpse_380353_authenticate_email_no_password( $user, $email, $password ) { if ( is_wp_error( $user ) || ( $user instanceof WP_User ) ) { // Already handled by a higher-priority filter return $user; … Read more