wp-login.php should not require additional effort from you to secure. However, I don’t think that’s what you client is asking for. My question therefore is does WordPress require further development to stop SQL injections etc on login forms? And do I need to apply input sanitation to the login fields? To wp-login.php, no, you don’t. … Read more
Turns out this is a total lie from the host company (or a misunderstanding on the part of the support people) as I managed to get access to the database and manually update the password hash and then it worked fine. So seems something somewhere has been changed by them.
When you say you removed the WP Super Cache plugin: did you deactivate the plugin, or just delete the plugins/wp-super-cache directory? I suspect the latter, because it looks like your site is still trying to load WP Super Cache files. You probably need to update your wp-config.php file to remove the define( ‘WP_CACHE’, true ); … Read more
I think a plugin did update ( if they are set to be auto-updated ), then this plugin may have crushed the dashboard. so you can try to test “manually disable plugins WordPress“
First for the usernames, you already have the answer: you can’t make the usernames the same, while you can make the username hidden for the user during registration, and set automatically, for example, based on the user’s email address Second for the other fields, they already work the way you want and are not unique. … Read more
Don’t use both wp_login() and wp_signon(). They do the same thing, but first one is deprecated Use the 2.8 widget API Put wp_signon() inside a function that you hook on the init tag (You can handle the errors in the widget() function)
wp_login_form(); // Codex: http://codex.wordpress.org/Function_Reference/wp_login_form // or: wp_loginout(); // Codex: http://codex.wordpress.org/Function_Reference/wp_loginout if ( ! is_user_logged_in() ) // Codex: http://codex.wordpress.org/Function_Reference/is_user_logged_in wp_register(”, ”); // Codex: http://codex.wordpress.org/Function_Reference/wp_register
this should give you the same look unless your theme’s css overwrites it: <form name=”loginformfooter” class=”loginform” id=”loginformfooter” action=”https://wordpress.stackexchange.com/questions/19222/<?php bloginfo(“url’); ?>/wp-login.php” method=”post”> <p><label>Username <input type=”text” value=”” maxlength=”40″ size=”13″ id=”user_login” name=”user_login” class=”text”> </label> <label>Password <input type=”password” maxlength=”40″ size=”13″ id=”password” name=”password” class=”text”> </label> <input type=”hidden” value=”” name=”re”> <input type=”submit” value=”Log in” id=”submit” name=”Submit” class=”button-secondary”> (<a href=”https://wordpress.stackexchange.com/questions/19222/<?php bloginfo(“url’); ?>/wp-login.php?action=lostpassword”>forgot?</a>) … Read more
You could add a statement to the end that require them to answer a question if they dont have a cookie set and sets a cookie when they do, allowing them access to the site. I’m on my phone but something like this. <?php if($_POST[‘q’] == ‘answer’) { // set cookie } elseif($_COOKIE[‘q’] != ‘cookie’) … Read more
get_currentuserinfo(); $username = $current_user->user_login That should work to get the current user’s username. You can read more about get_currentuserinfo(); here in the codex. It pulls all the base info about a user – username, display name, email, first/last name, and user ID. This will be handy since you can verify the user based on username, … Read more