Let’s say we’ve customized a beautiful user registration form, with extra fields, well-designed interface blending nicely with the theme. But how about when you type in this url:
http://url/wp-login?action=register
Well, because we allow “Anyone can register” in general settings, the register link is open to public. Which will lead visitors to the default registration page you wanted to hide at the first place.
While working on a website, adjusting the custom logo for WordPress login form, I suddenly run into an error: After unusual long page loading time, I got a “This webpage has a redirect loop” error on browser window, instead of the login form. The page URL is: http://yoursiteurl/wp-login.php
The last thing I did was to add one line code in style.css, and there is no problem there. It is weird and out of blue. Well, giving this is a live website, I have to fix it immediately.
In previous post, I mentioned a security tip called “Password Protect WordPress Admin Directory (wp-admin) for Enhanced Security“. Beside http://your-url/wp-admin, there is another login link to your site, which is http://your-url/wp-login.php. Matter of fact, http://your-url/wp-admin still requires access to file wp-login.php, a file seating outside wp-admin folder. It makes sense to extend password protection strategy to wp-login.php as well.
