The answer is most likely XML-RPC which is used to communicate with the mobile wordpress apps and is always on in newer versions. If you don’t use mobile apps to admin your WP you can use my plugin – http://wordpress.org/plugins/control-xml-rpc-publishing/ to disable it.
To solve this problem using a file manager (or FTP), rename your plugins folder. You can rename it anything – for example, “backupplugins”. This will disable all plugins. You’ll also need to clear your browser cache/history completely or use an incognito window so your browser doesn’t continue redirecting you. Once you can log in successfully, … Read more
If you look the wp-login.php file, you will see a hook login_header. So you add any custom content above the login form. Here is the example: add_action( ‘login_header’, ‘wpse330527_add_html_content’ ); function wpse330527_add_html_content() { ?> ENTER YOUR HTML CODE <?php } You will add the code into functions.php file of your active theme.
You could hook into the wp_authenticate_user filter and return an error. Something like: add_filter( ‘wp_authenticate_user’, ‘wpse_406123_stop_login’, -1 ); function wpse_406123_stop_login() { $message = new WP_Error( ‘login_disabled’, __( ‘<strong>ERROR</strong>: You cannot login at this time’ ) ); return $message; } You can then change your security keys –the ones that look like this to something different … Read more
template_redirect is called on every page load including the home page so your code will redirect the user to the homepage even when user is visiting the homepage You could add another condition there, is_home() or is_front_page(), depending on the setting in admin, but i recommend a longer approach for better compatibility a) Hook into … Read more
Clients typically use XML-RPC Support. If you take a look at your page source you will likely see endpoint declaration: <link rel=”EditURI” type=”application/rsd+xml” title=”RSD” href=”http://example.com/xmlrpc.php?rsd” /> <link rel=”wlwmanifest” type=”application/wlwmanifest+xml” href=”http://example.com/wp-includes/wlwmanifest.xml” /> Apps are using this information and your credentials to access the site. In this way they can either discover location of admin or work … Read more
Check for an empty user login in the $_REQUEST array: if ( empty( $_REQUEST[‘user_login’] ) // && or || empty( $_REQUEST[‘user_pass’] ) return $redirect_to_whereever_you_want; But this filter is to late. It is called after the user is logged in. You have to use the ‘wp_authenticate’ action, this is one of the earliest action in the … Read more
To login as a user you just need the target user ID and these two functions: wp_set_current_user( $user_id ); wp_set_auth_cookie( $user_id ); If you do this mid-page, make sure you refresh it to reflect the changes.
You can grab some ideas from this tutorial: http://carlofontanos.com/auto-login-to-wordpress-from-another-website/ hope it helps.
you can change the type of data used for signing in for the username portion, assuming it’s data that you have stored about the user (either in the main user table or usermeta). there would still need to be a password, but that in theory could also be mapped to the same data (phone number … Read more